Government agencies in the US, UK, Canada, Australia, and New Zealand have published guidance for software makers to eliminate memory safety vulnerabilities.
The document, named Case for Memory Safe Roadmaps, recommends the adoption of memory safe programming languages, which will help eliminate well-known and common coding errors that threat actors routinely exploit in malicious attacks.
Memory safety bugs, the Five Eyes government agencies note, persist despite significant efforts put into reducing their prevalence.
Transitioning to an MSL should eliminate this type of security flaws and reduce their impact, allowing both developers and customers to invest resources in other areas.
Some of the mitigation methods used to reduce memory safety bugs include developer training, code coverage, secure code guidelines, fuzzing, the use of static application security testing and dynamic application security testing tools, and the use of safer language subsets.
To reduce the impact of this type of vulnerabilities, defenders have marked memory segments as non-executable, adopted Control Flow Integrity, Address Space Layout Randomization, sandboxing, and other mitigation methods, and are considering the use of hardware to support memory protections.
The adoption of MSLs should bring benefits to both software makers and their customers, by improving code reliability, reducing the need to patch the reported vulnerabilities and the number of emergency releases, and ultimately reducing the number of urgent updates that customers will need to install, as well as data breaches.
When developing a memory safety roadmap, software manufacturers should consider how to prioritize transition, the use of appropriate MSLs, and how they will train developers.
For each of these aspects, the Five Eyes agencies recommend specific steps to follow.
The guidance also provides an overview of the implementation challenges that software makers will encounter when adopting MSLs, as well as details on the elements that a memory safety roadmap should include.
This Cyber News was published on www.securityweek.com. Publication date: Thu, 07 Dec 2023 16:13:04 +0000