In a joint report by the FBI, the US Cybersecurity and Infrastructure Security Agency (CISA) and its Canadian and Australian counterparts, experts have warned many open source programs lack sufficient protection against emerging and evolving threat actors.
In its analysis of 172 open source projects, the CISA highlighted the importance of using memory-safe languages in preventing many vulnerabilities.
The report claims only half (52%) of the projects contained code written in a memory-unsafe language.
US government highlights the importance of memory-safe languages
Memory safety is crucial in preventing common vulnerabilities like buffer overflows and use-after-free errors. Popular coding languages like Rust, Java, Goland, C# and Python are designed to manage memory automatically, reducing the likelihood of these vulnerabilities.
However, other popular languages like C, C++ and Assembly require manual memory management, which opens up the doors to potential flaws.
Popular open source projects that use unsafe code include Linux (which comprises 95% unsafe code), Tor (93%), MySQL Server (84%) and even Chromium (51%), highlighting the widespread dependency on memory-unsafe languages.
Conversely, projects like WordPress and PowerShell were found to be made up of entirely memory-safe code.
The CISA highlighted the practical challenges faced by developers when it comes to using safer languages, such as performance needs and resource constraints. However the report acknowledges ongoing work: “Recent advancements allow memory safe programming languages, such as Rust, to parallel the performance of memory-unsafe languages.”
The joint report recommends that developers prioritize memory-safe languages for new code as well as transition critical existing components to safer alternatives. Besides language selection, the agencies also emphasize the importance of following secure practices, managing dependencies correctly and conducting methodical testing to identify and mitigate such safety issues.
