POPL 2025
Sun 19 - Sat 25 January 2025 Denver, Colorado, United States

This program is tentative and subject to change.

Mon 20 Jan 2025 14:00 - 14:24 at Room 5 - Session 3

We introduce Cargo Scan, the first interactive program analysis tool designed to help developers audit third-party Rust code. Real systems written in Rust, like systems written in other safe languages, rely on thousands of transitive dependencies. Unfortunately, third-party code written in Rust is as dangerous as code written in C or JavaScript — and auditing this code today is similarly manual and just as painstaking. To this end, Cargo Scan takes advantage of Rust’s type and module system to automatically analyze third party crates and reduces the manual audit burden to only inspecting the parts of functions that perform potentially dangerous side-effects and (in some cases) those functions’ calling contexts. Using this analysis, we find that over 85% of top 1,000 crates are safe to use with no manual inspection. And, as our evaluation auditing the popular hyper crate and its dependencies shows, Cargo Scan can (1) reduce the auditing burden of potentially dangerous code to a median of 13.2% of lines of code when compared to auditing whole crates and (2) pinpoint dangerous side-effects previously missed by manual audits that led to CVEs.

This program is tentative and subject to change.

Mon 20 Jan

Displayed time zone: Mountain Time (US & Canada) change

14:00 - 15:30
Session 3PriSC at Room 5
14:00
24m
Talk
Auditing Rust Crates Effectively
PriSC
Lydia Zoghbi University of California, San Diego, David Thien University of California, San Diego, Ranjit Jhala UCSD, Deian Stefan University of California at San Diego, Caleb Stanford University of California, Davis
14:25
24m
Talk
Automatic Inference of Enclave Placement in LLVM Compiler
PriSC
Wesley B Nuzzo University of Massachusetts, Lowell (UML), Mohamed Elwakil U.S. Coast Guard Academy, Anitha Gollamudi University of Massachusetts Lowell
14:50
24m
Talk
Counterexamples in Safe Rust
PriSC
Muhammad Hassnain University of California, Davis, Caleb Stanford University of California, Davis
15:15
15m
Talk
Lightning talks
PriSC