The US Cybersecurity and Infrastructure Security Agency (CISA) has published research examining 172 key open source projects and whether they are vulnerable to memory flaws.
See also: CISA warns of potential CSAT data theft
The report, co-authored by CISA, the Federal Bureau of Investigation (FBI), as well as organizations in Australia (ASD, ACSC) and Canada (CCCS), is a follow-up to the “Case for Memory Safe Roadmaps” released in December 2023, aimed at raising awareness about the importance of memory-safe code.
Memory security
Memory-safe languages are programming languages designed to prevent common memory-related errors , such as buffer overflows, use-after-free , and other types of memory corruption. They achieve this by managing memory automatically rather than relying on the programmer to implement safe memory allocation and deallocation mechanisms.
A modern example of a safe language system is Rust 's borrow checking , which eliminates race conditions. Other languages such as Golang, Java, C# , and Python manage memory through garbage collection, automatically reclaiming freed memory to prevent exploitation .
Memory-unsafe languages are those that do not provide built-in memory management mechanisms, placing this responsibility on the programmer and increasing the likelihood of errors. Examples of such cases are C, C++, Objective-C, Assembly, Cython, and D.
See also: CISA: Scammers impersonate its employees in phone calls
The CISA report presents research examining 172 widely deployed open source projects, finding that over half contain memory-unsafe code.
The key findings presented in the report are summarized as follows:
- 52 % of critical open source projects analyzed contain code written in memory-unsafe languages.
- 55 % of the total lines of code (LoC) in these projects are written in memory-unsafe languages.
- Larger works are disproportionately written in memory-unsafe languages.
- Of the ten largest projects, each has a LoC memory insecure ratio of over 26%.
- The median proportion of LoC memory insecurity across these large projects is 62.5%, with four projects exceeding 94%.
- Even projects written in memory-safe languages often depend on components written in unsafe languages.
- Some notable examples from the examined set are Linux (95% insecure code ratio), Tor (93% insecure code ratio), Chromium (51% insecure code ratio), MySQL Server (84% insecure code ratio), glibc (85% insecure code ratio), Redis (85% insecure code ratio), SystemD (65%), and Electron (47%).
See also: CISA warns of Chrome, D-Link vulnerability exploitation
Beyond the CISA findings, however, open source projects represent an example of collaborative software development where source code is made publicly available for anyone to view, modify, and distribute. This approach promotes innovation and community participation, enabling developers from around the world to contribute their expertise, find and fix bugs, and improve the functionality of the software. Popular examples of successful open source projects include the Linux operating system , the Apache HTTP server, and the Mozilla Firefox web browser . By leveraging the collective knowledge and skills of a diverse community, open source projects often result in powerful, secure, and flexible software solutions that benefit both users and developers.
Source: bleepingcomputer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
