CybersecurityCISA and Global Partners Press for Memory-Safe Roadmaps — November 14, 2023
Nineteen international agencies urged technology manufacturers to publish transition plans away from memory-unsafe languages and legacy code.
Fact-checked and reviewed — Kodi C.
On the Cybersecurity and Infrastructure Security Agency CISA released guidance calling on software manufacturers to develop roadmaps for eliminating memory safety vulnerabilities from their products. The guidance recommends transition to memory-safe programming languages and represents a significant shift toward holding software producers accountable for vulnerability classes that have plagued the industry for decades.
Understanding Memory Safety Vulnerabilities
Memory safety vulnerabilities including buffer overflows, use-after-free errors, and out-of-bounds reads have been among the most exploited vulnerability classes throughout computing history. These vulnerabilities arise from programming language design decisions that focus on performance over safety, allowing programs to access memory in unintended ways.
- Prevalence of memory bugs. Research shows that memory safety vulnerabilities account for approximately 70 percent of severe vulnerabilities in major software products. This concentration makes memory safety a high-use target for improving overall software security.
- Exploitation patterns. Memory safety bugs enable attackers to execute arbitrary code, escalate privileges, and compromise system integrity. Many significant cyberattacks have exploited memory safety vulnerabilities in widely-deployed software.
- Root cause analysis. The primary root cause is use of memory-unsafe languages like C and C++ that provide direct memory access without runtime safety checks. Modern memory-safe languages eliminate entire vulnerability classes through language design.
Memory-Safe Language Alternatives
The guidance recommends evaluating memory-safe programming languages as replacements for memory-unsafe codebases. Several mature languages provide memory safety guarantees while maintaining performance characteristics acceptable for most applications.
- Rust. Rust provides memory safety through its ownership system and borrow checker, catching memory errors at compile time without garbage collection overhead. Major projects including portions of the Linux kernel have adopted Rust for new development.
- Go. Go provides memory safety through garbage collection and runtime bounds checking, with a simpler learning curve than Rust. Google has used Go extensively for systems programming where memory safety is important.
- Java and C-Sharp. These established managed languages provide memory safety through garbage collection and have extensive ecosystem support, though with different performance characteristics than systems languages.
Roadmap Development Guidance
CISA recommends that software manufacturers develop explicit roadmaps for achieving memory safety across their product portfolios. Roadmaps should address both new development and migration of existing codebases.
- Inventory and prioritization. Identify memory-unsafe code across product portfolios and focus on based on exposure, criticality, and feasibility of remediation.
- New development policies. Establish policies requiring memory-safe languages for new components, with exception processes for cases where memory-unsafe languages remain necessary.
- Migration strategies. Develop incremental migration approaches for existing codebases, potentially starting with security-critical components or new feature development within existing products.
- Timeline commitments. Establish and communicate timelines for achieving memory safety milestones, enabling customers to assess manufacturer commitment to secure development.
Industry Response and Adoption
Major technology companies have begun responding to memory safety concerns with language adoption initiatives. Microsoft has announced plans to incorporate Rust into Windows development, Google uses Rust in Android, and the Linux kernel has accepted Rust as a second development language.
Implications for Software Procurement
Organizations procuring software should consider incorporating memory safety criteria into vendor assessments and contract requirements. Requesting information about vendor memory safety roadmaps and current language distributions provides insight into long-term security posture and vendor commitment to addressing systemic vulnerability sources.
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Cybersecurity Operations Playbook
Use our research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.
-
Network Security Fundamentals Explained Practically
A practitioner-focused guide to network security fundamentals covering firewalls, segmentation, IDS/IPS, DNS security, VPNs, wireless security, zero trust architecture, and traffic…
-
Small Business Cybersecurity Survival Checklist
A budget-conscious cybersecurity checklist built specifically for small businesses. This guide covers foundational security policies, network hardening, employee training, phishing…
Coverage intelligence
- Published
- Coverage pillar
- Cybersecurity
- Source credibility
- 89/100 — high confidence
- Topics
- Global · CISA · Secure by design · Software security
- Sources cited
- 4 sources (cisa.gov)
- Reading time
- 5 min
Source material
- AA23-319A — The Case for Memory Safe Roadmaps
- CISA Blog — Software Manufacturers Must Build Memory Safe Roadmaps
- Secure by Design pledge launch — Cybersecurity and Infrastructure Security Agency
- Secure by Design pledge fact sheet — Cybersecurity and Infrastructure Security Agency
Comments
Community
We publish only high-quality, respectful contributions. Every submission is reviewed for clarity, sourcing, and safety before it appears here.
No approved comments yet. Add the first perspective.