RustGo: Fairly Directed Greybox Fuzzing for Enforcing Rust Memory Safety

2026-08-06

AI Summary

Existing fuzzing approaches exhibit limited efficacy on Rust programs because they redundantly test memory-safe code already guaranteed by the compiler, thereby overlooking genuine vulnerabilities that reside exclusively within unsafe code. To address this, this work proposes RustGo—the first directed greybox fuzzer tailored for Rust—which integrates static analysis to precisely identify potential memory-safety targets and introduces a novel target-guided dynamic path pruning mechanism coupled with isolated state maintenance. This design concentrates testing resources on relevant code paths while preserving coverage fairness. Experimental results demonstrate that RustGo prunes, on average, 78.49% of irrelevant paths, accelerates target reachability by 2.09–5.08×, and successfully uncovers 13 previously unknown vulnerabilities, including six assigned RUSTSEC advisories and one CVE.

Abstract

Rust is a popular systems programming language that provides strong memory safety and introduces low-performance overhead. While Rust guarantees memory safety through strict security policies, such as ownership, memory bugs can still occur in unsafe-related Rust codes where these policies are not fully enforced. Although such unsafe Rust code accounts for only a small portion of the entire code (e.g., 10%), existing approaches fuzz the entire code-including safe Rust, whose memory safety is already enforced by the Rust compiler-resulting in inefficient use of fuzzing resources. In this paper, we propose RustGo, the new Rust-directed greybox fuzzer that effectively and fairly focuses on code regions potentially containing memory bugs. For this, RustGo automatically identifies potential memory bug targets and accurately prunes the paths irrelevant to each target by leveraging Rust-specific static analysis. For each identified target, RustGo includes a new fuzzing approach that maintains an independent state and applies dynamic pruning to maximize balanced and focused fuzzing. We evaluate RustGo on various real-world Rust applications. On average, RustGo prunes 78.49% of irrelevant paths, reaches targets x 2.09 to x 5.08 faster than existing fuzzers, and identifies 13 unknown bugs (six assigned RUSTSEC IDs and one assigned CVE ID).

Problem

• Rust
• memory safety
• greybox fuzzing
• unsafe code
• fuzzing efficiency

Innovation

• directed greybox fuzzing
• Rust memory safety
• static analysis
• path pruning
• unsafe code