This work presents the first longitudinal and systematic empirical study of Rust in AOSP, shedding light on its adoption, integration, and governance in a safety-critical mobile platform and provides industry practitioners with an empirical foundation and practical guidance for similar memory-safe migrations in large-scale production systems.
Abstract
The Android Open Source Project (AOSP) powers the world's largest mobile ecosystem, yet memory-safety vulnerabilities remain prevalent in native components due to the inherent risks of languages like C and C++, which allow manual memory management and unsafe operations. To mitigate these risks, AOSP began adopting Rust, a language with compile-time memory-safety guarantees, in 2021. However, the trajectory, mechanisms, and effectiveness of this transition remain empirically uncharted. We present the first longitudinal and systematic empirical study of Rust in AOSP. By analyzing 16 quarterly snapshots from January 2021 to October 2024, we track adoption trends and map the distribution of Rust code across 67 components. We further align Android Security Bulletin vulnerabilities with these components to assess memory-safety outcomes before and after Rust adoption, while also identifying the remaining non-Rust hotspots that may warrant future migration. In addition, we characterize platform-level integration mechanisms and examine unsafe governance through a large corpus of SAFETY comments, from which we distill actionable best practices and anti-patterns. Taken together, these results clarify Rust's role in AOSP by shedding light on its adoption, integration, and governance in a safety-critical mobile platform. They also provide industry practitioners with an empirical foundation and practical guidance for similar memory-safe migrations in large-scale production systems.
Results indicate that Rust's compile-time guarantees dominate at the systems layer, while managed backend frameworks offer stronger built-in defenses at the application layer, suggesting that Rust adoption in web contexts requires complementary safeguards rather than reliance on language-level safety alone.
Md Zarzees Uddin Shah Chowdhury, Rabib Jahin Ibn Momin, Rifat Shahriyar· 0 citations
This paper investigates how programming language standards influence memory safety by analyzing three distinct approaches: the manual memory management of C++, the ownership-based compile-time model of Rust, and the automatic garbage collection of Python.
Gordon Bednarz, Ludvig Kåhlin, Oliver Andersson· 0 citations
Software security has been a long-standing and prominent topic in both industry and academia. However, with the increasing deployment of smart devices across various architectures, there is now a significant demand for cross-architecture software. For instance, the Heartbleed vulnerability (CVE-2014-0160), classified as CWE-125 (Out-of-bounds Read) and disclosed in the OpenSSL library in 2014, serves as a prime example of a widely-deployed software vulnerability capable of affecting systems across diverse computing environments due to OpenSSL’s broad adoption. More broadly, memory-related vulnerabilities remain a persistent and significant threat, accounting for a substantial proportion of reported CVEs in recent years. Moreover, performing static cross-architecture vulnerability analysis on binary code poses particular challenges due to the variations in instruction sets across different architectures. In this paper, we present a novel static approach, called BinCros, to identify known vulnerabilities across different optimization levels and CPU architectures in binary code. It mainly consists of three phases: 1) Generating ground-truth intermediate representation (IR) data from binary code based on domain knowledge. To address the cross-architecture problem, we consider IR, which is a set of smaller, lower-level instructions that break down, describe, and capture all the effects of an instruction from standard architectures like x86, ARM, and MIPS; 2) Learning good embeddings based on the cross-architecture ground-truth datasets. We employ a code-code learning method to capture the semantic differences and maximize the distribution divergences between vulnerable and non-vulnerable samples; 3) Building a prediction model based on high-level feature representations. To demonstrate the effectiveness of BinCros, we conducted experiments with a series of baselines including single architecture-based techniques, cross-architecture-based techniques, and so on. Experimental results show that BinCros outperforms the baselines by at least 15% in terms of F1-measure in almost all cases. We believe this work will inspire other researchers to consider natural language processing-related techniques for cross-architecture software vulnerability detection.
Shigang Liu, Di Cao, Chao Chen et al.· IEEE Transactions on Informa...· 0 citations
Differential fuzzing reveals complementary bugs in the manual and LLM porting of security-critical C libraries to idiomatic Rust and translates these findings into concrete practical guidance for teams planning a similar migration.
Marco Parrillo, Marco Grassi, Luigi Laura· Future Internet· 0 citations
SNIPTEST is an execution-based warning triage framework that generates and fuzzes compiled code slices centered around static-analysis warnings that employs a layer-by-layer slicing strategy, incrementally expanding context around the target location to validate potential vulnerabilities with increasing precision.
Aniruddhan Murali, Noble Saji Mathews, Mahmoud Alfadel et al.· IEEE Transactions on Softwar...· 0 citations
Automated vulnerability repair with large language models is increasingly woven into security workflows, yet evaluation practice has focused almost entirely on a single question: does the patch eliminate the targeted weakness? However, an equally important question has received little systematic attention: has the patching act itself introduced new weaknesses into the function being repaired? Bypass testing and regression measurement are orthogonal properties, and neglecting the latter leaves a material blind spot in any assessment of patch quality.This paper presents an empirical study of vulnerability regression in LLM-generated security patches, applying differential static analysis to 479 complete C/C++ functions spanning eight CWE types. Patches are generated from three frontier models alongside developer-authored ground-truth fixes, for a total of 1,916 analyzed patch–function pairs. AI models fix targeted vulnerabilities at rates approaching human developers, yet they leave a meaningfully larger share of patches in a structurally neutral state, modifying code without engaging its underlying weakness. Across all three AI models, regression rule sets are more similar to each other than to human regression patterns, a consistency specific enough to target with shared automated validators. Finally, for human developers, successfully fixing a vulnerability is strongly associated with lower regression risk. However, this association is absent and not statistically detectable for AI patchers, a distinction with direct implications for how AI patch quality should be verified.
Yasmeen Rawajfih, Adiba Mahmud, Ross Arnold· International Conference on...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
