RustGo: Fairly Directed Greybox Fuzzing for Enforcing Rust Memory Safety

arXiv:2608.05870 · cs.CR · Submitted 2026-08-06 · Read on arXiv

Dongyeon Yu, Jiun Min, Yewan Na, Mijung Kim, Taegyu Kim, Yuseok Jeon

Korea University · Korea University · Ulsan National Institute of Science and Technology · Ulsan National Institute of Science and Technology · The Pennsylvania State University · Korea University

cs.CR

Submitted: 2026-08-06

Comments: To appear in the Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS 2026). 23 pages

Code: https://github.com/google/oss-fuzz

Project page: https://nnethercote.github.io/perf-book/bounds-checks.html

License: http://creativecommons.org/licenses/by/4.0/

The gist: Rust is a popular systems programming language that provides strong memory safety and introduces low-performance overhead.

Terminology

Abstract

Rust is a popular systems programming language that provides strong memory safety and introduces low-performance overhead. While Rust guarantees memory safety through strict security policies, such as ownership, memory bugs can still occur in unsafe-related Rust codes where these policies are not fully enforced. Although such unsafe Rust code accounts for only a small portion of the entire code (e.g., 10%), existing approaches fuzz the entire code-including safe Rust, whose memory safety is already enforced by the Rust compiler-resulting in inefficient use of fuzzing resources. In this paper, we propose RustGo, the new Rust-directed greybox fuzzer that effectively and fairly focuses on code regions potentially containing memory bugs. For this, RustGo automatically identifies potential memory bug targets and accurately prunes the paths irrelevant to each target by leveraging Rust-specific static analysis. For each identified target, RustGo includes a new fuzzing approach that maintains an independent state and applies dynamic pruning to maximize balanced and focused fuzzing. We evaluate RustGo on various real-world Rust applications. On average, RustGo prunes 78.49% of irrelevant paths, reaches targets x 2.09 to x 5.08 faster than existing fuzzers, and identifies 13 unknown bugs (six assigned RUSTSEC IDs and one assigned CVE ID).

Sources

Related papers