UnsafeChecker detects hidden safety bugs in Rust libraries
UnsafeChecker: Finding Soundness Bugs in Rust Safe Abstractions
Programming Languages
Summary
Rust promises safe memory management, but some Rust libraries use risky 'unsafe' code hidden inside safe interfaces, which can cause subtle bugs. The authors developed UnsafeChecker, a tool that scans Rust programs to find these hidden mistakes before they cause problems. Their tool checks how Rust tracks ownership and memory safety at a deep level to catch bugs that other tools miss. UnsafeChecker found many real bugs in widely used Rust code, helping programmers make safer software.
What this means in practice
- •For rust library developers: Detect subtle bugs in unsafe code hidden behind safe Rust interfaces to ensure memory safety contracts hold.
- •For systems programmers: Scan and verify Rust crates for correctness of safety guarantees before deployment in critical systems.
Authors
Xizhe Yin, Yaokun Zhang, Yang Feng, Baowen Xu
Abstract
Rust guarantees memory safety without garbage collection through a strict ownership and borrowing system. However, for low-level systems programming, many widely used libraries rely on the unsafe keyword. These libraries encapsulate raw-pointer operations behind safe APIs to form safe abstractions. A single mistake in this internal unsafe code can break its safety contract, rendering the abstraction unsound and allowing safe clients to trigger undefined behavior. Detecting these potential soundness violations is challenging. Existing static analysis tools for C/C++ ignore Rust-specific safety contracts, while current Rust tools lack the deep semantic modeling required to track the contexts that raw pointers erase. To address this gap, we present UnsafeChecker, a compiler-integrated static analysis framework for detecting potential soundness violations in Rust safe abstractions. UnsafeChecker analyzes Rust MIR using a flow-sensitive abstract interpretation that maintains a shared state with three components: ownership, object validity, and layout. Each warning rule consumes the subset of facts needed for the corresponding Rust safety obligation. UnsafeChecker reports both instruction-level undefined behavior and boundary-level contract violations that may escape through safe APIs. We evaluate UnsafeChecker on a benchmark of 46 RustSec vulnerabilities, which contain 53 ground-truth bugs. UnsafeChecker outperforms several state-of-the-art tools, detecting 32 CVEs and covering 36 bugs (67.9% recall) with 51.6% alert-level precision. Furthermore, in a large-scale scan of real-world crates on crates.io, UnsafeChecker uncovered 114 previously unknown bugs across 83 crates, with 45 confirmed and 27 already fixed by maintainers.