arXiv:2506.15648cs.CRcs.LG2025-06被引 5

用大模型辅助生成测试用例,自动发现Rust库中的内存漏洞。

deepSURF: Detecting Memory Safety Vulnerabilities in Rust Through Fuzzing LLM-Augmented Harnesses

  • 结合静态分析与大模型生成测试代码,自动处理泛型和自定义行为。
  • 在63个真实项目中发现12个未知漏洞,11个获官方安全编号。
  • 适合安全研究人员和Rust开发团队用于提升代码健壮性。

尽管Rust默认保障内存安全,但允许使用unsafe代码,若使用不当仍可能引入内存安全漏洞。现有工具在检测能力、对Rust特有类型处理或依赖人工干预方面存在不足。为此,我们提出deepSURF,通过静态分析结合大语言模型(LLM)引导的模糊测试用例生成,有效识别Rust库中的内存安全漏洞,重点针对unsafe代码。deepSURF创新性地通过自定义类型替换泛型,并生成所需特质的定制实现,使模糊测试器能模拟用户定义的行为。此外,利用LLM动态增强测试用例,促进复杂API交互探索,显著提升暴露内存漏洞的概率。我们在63个真实Rust仓库上评估deepSURF,成功复现30个已知漏洞,并发现12个此前未知的漏洞(其中11个已分配RustSec ID,3个已修复),显著优于现有最先进工具。

原文摘要 · Abstract (English)

Although Rust ensures memory safety by default, it also permits the use of unsafe code, which can introduce memory safety vulnerabilities if misused. Unfortunately, existing tools for detecting memory bugs in Rust typically exhibit limited detection capabilities, inadequately handle Rust-specific types, or rely heavily on manual intervention. To address these limitations, we present deepSURF, a tool that integrates static analysis with Large Language Model (LLM)-guided fuzzing harness generation to effectively identify memory safety vulnerabilities in Rust libraries, specifically targeting unsafe code. deepSURF introduces a novel approach for handling generics by substituting them with custom types and generating tailored implementations for the required traits, enabling the fuzzer to simulate user-defined behaviors within the fuzzed library. Additionally, deepSURF employs LLMs to augment fuzzing harnesses dynamically, facilitating exploration of complex API interactions and significantly increasing the likelihood of exposing memory safety vulnerabilities. We evaluated deepSURF on 63 real-world Rust crates, successfully rediscovering 30 known memory safety bugs and uncovering 12 previously-unknown vulnerabilities (out of which 11 have been assigned RustSec IDs and 3 have been patched), demonstrating clear improvements over state-of-the-art tools.

Rust安全模糊测试大模型应用内存漏洞

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。