Memory safety vulnerabilities are the most prevalent type of disclosed software
vulnerability.1,2,3 They are a class of well-known and common coding errors that malicious
actors routinely exploit. These vulnerabilities represent a major problem for the software
industry as they cause manufacturers to continually release security updates and their
customers to continually patch. These vulnerabilities persist despite software manufacturers
historically expending significant resources attempting to reduce their prevalence and
impact through various methods, including analyzing, patching, publishing new code and
investing in training programs for developers. Customer organizations expend significant
resources responding to these vulnerabilities through onerous patch management programs
and incident response activities.
Memory safe programming languages (MSLs) can eliminate memory safety vulnerabilities.
Therefore, transitioning to MSLs would likely greatly lessen the need to invest in activities
aimed at reducing these vulnerabilities or minimizing their impact. Additionally, investments
to migrate unsafe codebases to MSLs would pay long-term dividends in the form of safer
products—defraying some of the upfront cost of transitioning to MSLs. The authoring
agencies jointly developed this guidance
as part of our collective Secure by Design
campaign. With this guidance, the authoring agencies urge senior executives at every
software manufacturer to reduce customer risk by prioritizing design and development
practices that implement MSLs. Additionally, the agencies urge software manufacturers to
create and publish memory safe roadmaps that detail how they will eliminate memory safety
vulnerabilities in their products. By publishing memory safe roadmaps, manufacturers will
signal to customers that they are taking ownership of security outcomes, embracing radical
transparency, and taking a top-down approach to developing secure products—key Secure
by Design tenets.
