Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Memory Safety and the Future of Vulnerabilities
Search
Andrew Lilley Brinker
April 15, 2025
Programming
0
12
Memory Safety and the Future of Vulnerabilities
Presented at the Cal Poly Pomona SWIFT Tech Symposium 2025.
Andrew Lilley Brinker
April 15, 2025
Tweet
Share
More Decks by Andrew Lilley Brinker
See All by Andrew Lilley Brinker
Hello and Welcome: Documentation in the Rust Ecosystem
alilleybrinker
0
4
A Tale of Teaching Rust
alilleybrinker
0
4
Efficient Nimber Calculation in Dots and Boxes
alilleybrinker
0
96
Other Decks in Programming
See All in Programming
GraphRAGの仕組みまるわかり
tosuri13
7
480
A2A プロトコルを試してみる
azukiazusa1
2
1.1k
データの民主化を支える、透明性のあるデータ利活用への挑戦 2025-06-25 Database Engineering Meetup#7
y_ken
0
320
iOSアプリ開発で 関数型プログラミングを実現する The Composable Architectureの紹介
yimajo
2
210
すべてのコンテキストを、 ユーザー価値に変える
applism118
2
790
『自分のデータだけ見せたい!』を叶える──Laravel × Casbin で複雑権限をスッキリ解きほぐす 25 分
akitotsukahara
1
540
関数型まつりレポート for JuliaTokai #22
antimon2
0
150
エラーって何種類あるの?
kajitack
5
310
Go1.25からのGOMAXPROCS
kuro_kurorrr
1
800
Julia という言語について (FP in Julia « SIDE: F ») for 関数型まつり2025
antimon2
3
980
「ElixirでIoT!!」のこれまでとこれから
takasehideki
0
370
PHPで始める振る舞い駆動開発(Behaviour-Driven Development)
ohmori_yusuke
2
190
Featured
See All Featured
Building an army of robots
kneath
306
45k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
44
2.4k
GraphQLの誤解/rethinking-graphql
sonatard
71
11k
Mobile First: as difficult as doing things right
swwweet
223
9.7k
Scaling GitHub
holman
459
140k
Intergalactic Javascript Robots from Outer Space
tanoku
271
27k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
10
930
A better future with KSS
kneath
239
17k
Bootstrapping a Software Product
garrettdimon
PRO
307
110k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
161
15k
Art, The Web, and Tiny UX
lynnandtonic
299
21k
The Illustrated Children's Guide to Kubernetes
chrisshort
48
50k
Transcript
Memory safety and the future of vulnerabilities A talk by
Andrew Lilley Brinker Approved for Public Release; Distribution Unlimited. Public Release Case Number 251031. The author’s affiliation with The MITRE Corporation is provided for identification purposes only, and is not intended to convey or imply MITRE’s concurrence with, or support for, the positions, opinions, or viewpoints expressed by the author. ©2025 The MITRE Corporation. ALL RIGHTS RESERVED.
I’m Andrew Principal Cyber Security Engineer MITRE Rustacean for
11 years I am not speaking for MITRE today.
What is memory safety?
What kinds of weaknesses? 1 buffer overflow 1. null pointer
dereference 2. use after free 3. use of uninitialized memory 4. illegal free (of an already-freed pointer, or a non- malloced pointer) 5. Michael Hicks, “What is memory safety,” http://www.pl-enthusiast.net/2014/07/21/memory-safety/ 1.
Or, this bigger list The Common Weakness Enumeration CWE
Memory Safety category
Spatial Memory Safety Out-of-bounds accesses Reads or writes, under or
over 1 Yoshua Wuyts, “What are temporal and spatial memory safety?” https://blog.yoshuawuyts.com/temporal-spatial-memory- safety/ 1.
Heartbleed was a spatial memory safety vulnerability
Why is that bad? Client: heartbeat “Hello” length 1,000 bytes
Server: heartbeat “HellobfsfhgafSocial Security Number 123456789…”
But Wait, There’s More! This is “Smashing the Stack
for Fun and Profit”
Temporal Memory Safety Use after free Use of uninitialized memory
Double-free
Memory safety is when these problems don’t happen Memory safe
languages stop memory safety problems
What languages are memory safe? From “The Case for
Memory Safe Roadmaps” Published by CISA, NSA, FBI, ASD’s ACSC, CCCS, NCSCUK, NCSCNZ, CERTNZ
Which ones aren’t? C and C
None
Rust 1.0 was May 15, 2015 Also the day of
my first date with my wife)
9 years later… The White House publishes this…
The govt. asked for input CISA / ONCD /
NSF / DARPA / OMB Request for Input RFI on open source software OSS security.
In the responses… Microsoft, Google, Cloudflare, GitHub, IBM, and many
others recommend moving to memory safe languages.
The move to memory safe languages is happening What does
this mean for vulnerabilities?
Let’s look at the CWE Top 25! In 2024 20%
are memory safety related – 35% known-exploited are memory safety related –
We’ll always have… Bad authentication / authorization – Bad neutralization
of user input – Resource exhaustion But what else? –
Micro- architectural vulnerabilities
Spectre and Meltdown Spectre: trick branch predictor into leaking data
Meltdown: read memory faster than the privilege check, then recover data from cache
These affected every Intel processor from 1995 to 2018
The hits start coming and they don’t stop coming Spectre,
Meltdown, Spectre-NG, SpectreRSB, Foreshadow, Zombieload, CROSStalk, Phantom, Zenbleed, Inception, Downfall
And it’s not just Intel! That’s from this year!
Turns out Apple CPUs since the M2 / A15 have a Load Address Predictor and Load Value Predictor. Oh no!
Problem: how to have fast processors that aren’t full of
speculative execution vulnerabilities
Cryptographic vulnerabilities
Cryptography libraries are better than they used to be
But… Primitives being correct doesn’t mean a protocol is secure
We need post-quantum cryptography Harvest now, decrypt later
Problem: many existing protocols can’t easily adapt to post-quantum cryptography
Supply Chain Vulnerabilities
Code reuse is good!
But: xz-utils Last year we narrowly avoided the worst open
source software supply chain attack in history.
Seriously, go read the story of this attack. Russ
Cox, co-creator of the Go programming language, has a great timeline
More commonly, we have stuff like this… Also: Typosquatting –
Malicious contributions – Account takeovers – Token reuse –
Conclusions
Memory safety vulns won’t disappear But they will become less
common
There’s still a lot to secure
Be Curious!
How to Reach Me Bluesky: LinkedIn: @alilleybrinker.com @alilleybrinker