Automatic c to rust refactoring tools do not ensure memory security
C-to-Rust Fallacy: Automatic Refactoring != Memory Security
Cryptography and Security
Summary
Many tools try to automatically convert C programs to Rust to fix memory safety bugs, since Rust is known for better memory safety. The authors tested several popular automatic refactoring tools on programs with known memory bugs. They found that many converted programs either fail to compile, still have memory bugs, or even gain new bugs. The study shows that while these tools reduce certain unsafe Rust code, that doesn’t guarantee the Rust code will be truly secure from memory errors.
What this means in practice
- •For software developers: Assess the reliability of automated C-to-Rust converters before using them to migrate legacy code safely.
- •For software security teams: Identify limitations of current refactoring tools in fully eliminating memory security flaws during automated language migration.
Authors
Hung-Mao Chen, Xu He, Bo Lu, Xiaokuan Zhang, Kun Sun
Abstract
Rust has emerged as the leading system programming language, offering strong memory and type safety guarantees without compromising performance. This positions it as a compelling alternative to traditional languages like C and C++, which are susceptible to memory security bugs. However, manually transforming C to Rust requires in-depth domain knowledge of the Rust language features, which requires significant effort for developers. To address this, tools for automatic C-to-Rust refactoring aim to generate safe Rust code leveraging static analysis and Large Language Models (LLMs). While these tools claim to achieve safety by reducing the unsafe Rust, the correlation with improving security is not clear. In this paper, we conduct a comprehensive empirical study on the reliability, safety, and correctness of various C-to-Rust refactoring methods. Specifically, we evaluate C2Rust-analyze, CROWN, C2SaferRust, and FLOURINE using a dataset of 116 C programs with memory security bugs from the NIST Juliet Test Suite. Based on 464 Rust programs generated by these tools, our evaluation focuses on three key aspects: the compilation correctness of the refactored programs, the effectiveness in mitigating original C bugs, and the tendency to introduce additional Rust bugs. The results indicate that 342 Rust programs fail to compile, 177 Rust programs inherit memory security bugs from the original C programs, and 77 new Rust bugs are introduced. We examine the rationale behind tool design and analyze the root cause of errors across various refactoring methods. Our findings indicate that current automated refactoring tools deliver memory safety as they define it, but not the broader memory security when adopting them.