Uncovering the Hidden Dangers: Finding Unsafe Go Code in the Wild

  title={Uncovering the Hidden Dangers: Finding Unsafe Go Code in the Wild},
  author={Johannes Lauinger and Lars Baumg{\"a}rtner and Anna-Katharina Wickert and Mira Mezini},
  journal={2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)},
The Go programming language aims to provide memory and thread safety through measures such as automated memory management with garbage collection and a strict type system. However, it also offers a way of circumventing this safety net through the use of the unsafe package. While there are legitimate use cases for unsafe, developers must exercise caution to avoid introducing vulnerabilities like buffer overflows or memory corruption in general. In this work, we present go-geiger, a novel tool… Expand

Figures and Tables from this paper


SafeCheck: Safety Enhancement of Java Unsafe API
This work proposes a memory checker to enforce memory safety, thus avoiding the JVM crash caused by the misuse of the Unsafe API at the bytecode level, and evaluates the runtime overhead of the tool on projects using intensive Unsafe operations. Expand
Fidelius Charm: Isolating Unsafe Rust Code
Fidelius Charm (FC) is presented, a system that protects a programmer-specified subset of data in memory from unauthorized access through vulnerable unsafe libraries, by limiting access to the program's memory while executing unsafe libraries. Expand
SoK: Eternal War in Memory
The current knowledge about various protection techniques are systematized by setting up a general model for memory corruption attacks, and what policies can stop which attacks are shown, to analyze the reasons why protection mechanisms implementing stricter polices are not deployed. Expand
Use at your own risk: the Java unsafe API in the wild
It is found that 25% of Java bytecode archives depend on unsafe third-party Java code, and thus Java's safety guarantees cannot be trusted. Expand
Everything Old is New Again: Binary Security of WebAssembly
This paper presents a set of attack primitives that enable an attacker to write arbitrary memory, to overwrite sensitive data, and to trigger unexpected behavior by diverting control flow or manipulating the host environment, and shows a perhaps surprising lack of binary security in WebAssembly. Expand
Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web
The first comprehensive study of client-side JavaScript library usage and the resulting security implications across the Web demonstrates that not only website administrators, but also the dynamic architecture and developers of third-party services are to blame for the Web's poor state of library management. Expand
Is Rust Used Safely by Software Developers?
A large-scale empirical study to explore how software developers are using Unsafe Rust in real-world Rust libraries and applications concludes that although the use of the keyword unsafe is limited, the propagation of unsafeness offers a challenge to the claim of Rust as a memory-safe language. Expand
Understanding Real-World Concurrency Bugs in Go
This study performs the first systematic study on concurrency bugs in real Go programs and provides a better understanding on Go's concurrency models and can guide future researchers and practitioners in writing better, more reliable Go software and in developing debugging and diagnosis tools for Go. Expand
SoK: Sanitizing for Security
This work provides a systematic overview of sanitizers with an emphasis on their role in finding security issues, taxonomize the available tools and the security vulnerabilities they cover, describe their performance and compatibility properties, and highlight various trade-offs. Expand
Vulnerable open source dependencies: counting those that matter
This case study shows that the correct counting allows software development companies to receive actionable information about their library dependencies, and therefore, correctly allocate costly development and audit resources, which is spent inefficiently in case of distorted measurements. Expand