Agencies issue joint report on memory safety vulnerabilities in open source projects

A joint report released June 26 by the Cybersecurity and Infrastructure Security Agency, FBI, the Australian Cyber Security Centre and Canadian Centre for Cybersecurity provides roadmaps for addressing memory safety vulnerabilities in open source software. The agencies explored a set of critical open source projects to determine the extent to which they were written in memory-unsafe languages and found that 52% of them had coding written in a memory-unsafe language, among other findings. The agencies determined that most critical open source projects analyzed, even those written in memory-safe languages, potentially contain memory safety vulnerabilities.  
  
“This report highlights the cyber risk of using potentially vulnerable open source code for internal coding projects or cyber risk exposure through third-party technology providers which may leverage open source code,” said John Riggi, AHA national advisor for cybersecurity and risk. “Useful recommendations include targeted rewrites of critical components in memory-safe languages and insisting that third-party software developers reduce this risk by implementing ‘secure by design, secure by default principles,’ which we as a sector can drive by including ‘security by demand’ in our software purchase requirements.” 
 
For more information on this or other cyber and risk issues contact Riggi at jriggi@aha.org. For the latest cyber and risk threat information and resources visit www.aha.org/cybersecurity.