Memory-safe Programming Goes from Advocacy to Adoption
Memory-safe Programming Goes from Advocacy to Adoption 🚀
Just over a year ago, the U.S. Cybersecurity and Infrastructure Security Agency and the National Security Agency released their report on the state of memory-safe languages (MSLs). The CISA/NSA report emphasized the vital importance of memory safety. It cited a 2019 study estimating that 66% of Common Vulnerabilities and Exposures (CVEs) for iOS 12 and 71% of CVEs for macOS Mojave stemmed from memory safety issues. It pointed to a Google Project Zero review of exploits detected in the wild, which estimated that 75% of the CVEs used in those exploits were memory safety vulnerabilities. Of the 58 in-the-wild zero days discovered in 2021, 67% were memory-safety vulnerabilities, Google found. Adopting memory-safe languages, the CISA/NSA report concluded, is a key strategy for improving software security and reducing the risk of costly incidents. The report argued that defining memory-safety road maps and adopting best practices can meaningfully improve software resilience across the industry, stating, “Strategic [MSL] adoption is an investment in a secure software future.”
All of this has led to real action. Major cloud and software providers are no longer just endorsing MSLs such as Rust – they’re building them into production systems, and AI tools are starting to lower the cost of migrating decades-old code. Boris Cipot, a security engineer at Black Duck Software, said awareness about memory safety is no longer the problem. The industry is adopting MSLs. “Major technology providers such as Microsoft, Google, Amazon, Cloudflare, and parts of the Linux ecosystem are actively adopting Rust or other memory-safe approaches in production systems,” Cipot said. John Strand, owner of Black Hills Information Security, traces that shift to a specific milestone: “When you started seeing Rust incorporated into the Linux kernel, that was kind of the opening shot in the race to see this become more mainstream. And I think we’re just going to see it become more mainstream moving forward.”
But the shift is far from settled. Security practitioners caution that legacy C and C++ code is too widely deployed and deeply embedded to replace wholesale and that MSLs solve only one category of vulnerability, not all of them. Jeff Williams, chief technology officer and co-founder of Contrast Security, foresees stubborn inertia: “There is an entire mountain range of software built in non-memory-safe languages. And there is a tiny amount of action in the foothills to switch.” Dmitry Polyakovsky, a lead principal platform software engineer at Oracle, concedes that point but nonetheless expects Rust to continue to make inroads even as legacy C and C++ code remains in place. “Rust can be a bridge for integrating new features into existing complex C/C++ codebases. As more developers become comfortable with Rust, new projects will be started in Rust from the beginning.” The NSA/CISA guidance recommends starting with new code and targeting components that handle untrusted files or network traffic. AI is emerging as a tool for migrating legacy code, pointing to Google’s Gemini-assisted rewrite of giflib as an early proof point: Google’s Rust replacement was unaffected by a memory-corruption flaw later disclosed in the original C library, meaning migrated systems never needed a patch for that flaw.