一句话：提出首个面向 Rust 的静态分析工具 DeRust，通过跨过程数据流追踪检测不安全类型转换引发的类型混淆缺陷。
Rust 以严格的内存与并发安全为目标，但 unsafe 代码仍可引入内存安全问题。其中不安全类型转换会把数据从一种类型重新解释为另一种类型，破坏类型的空间与时间属性，导致内存安全与数据损坏；此类转换还可能违背程序员意图的转换语义，使攻击者得以访问敏感内存，因此类型混淆缺陷具有严重安全影响。尽管 Rust 类型混淆缺陷不断增多，社区尚未系统研究并解决该问题。本文提出 DeRust——首个新颖的 Rust 类型混淆缺陷静态分析工具。DeRust 精确追踪从 unsafe 类型转换到敏感操作的跨过程数据流，从而高效且有效地识别类型混淆缺陷。评估表明，DeRust 能检出基准数据集中的全部类型混淆缺陷，并在前 1000 个 Rust 包中报告了 54 个此前未知的缺陷，其中 13 个获得 RustSec ID。
Rust is a modern programming language designed for strict memory and concurrency safety. Despite the safety checks, unsafe code in Rust can introduce memory safety issues. Unsafe type conversion, which reinterprets data from one type to another type, can alter the type spatial and temporal properties, leading to memory safety and data corruption issues. Since an unsafely converted value could violate a programmer’s intended conversion semantics and allows attackers to access the sensitive memory, type confusion bugs have critical security implications. Despite the increasing number of Rust type confusion bugs, the problem has not been systematically studied and addressed by the Rust community. In this paper, we propose DeRust, the first and a novel static analysis tool for detecting Rust type confusion bugs. By precisely tracking the inter-procedural data flows from unsafe type conversions to sensitive operations, DeRust can effectively and efficiently identify type confusion bugs. Our evaluation shows that DeRust can detect all the type confusion bugs in the benchmark datasets, and further helped report 54 previously unknown bugs in the top 1000 Rust packages with 13 RustSec IDs assigned.