[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["没有我需要的信息","missingTheInformationINeed","thumb-down"],["太复杂/步骤太多","tooComplicatedTooManySteps","thumb-down"],["内容需要更新","outOfDate","thumb-down"],["翻译问题","translationIssue","thumb-down"],["示例/代码问题","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-27。"],[],[],null,["# Memory safety\n\nMemory unsafety\n---------------\n\n\nMemory safety bugs, errors in handling memory in native programming\nlanguages, are the most common issue in the Android codebases. They account for\nover 60% of high severity [security vulnerabilities](https://security.googleblog.com/2021/01/data-driven-security-hardening-in.html) and for millions of\nuser-visible crashes.\n**Figure 1**: Memory safety bugs and their negative impact on quality, security, and costs\n\n\nMemory safety bugs negatively impact quality and stability and account for a\nsignificant share of the crashes observed on end user devices. Therefore a high\ndensity of memory safety bugs directly correlates with poor user experience. \n\nNative code, written in memory unsafe languages like C, C++, and Assembly\nrepresent over 70% of the Android platform code and is present in approximately\n50% of Google Play Store apps. \n\nGiven the ever increasing complexity of code, if left unattended, memory\nsafety bugs are going to increase over time. Therefore, providing our ecosystem\nwith the tools and technologies that can detect and mitigate such bugs is\ncritical to our long term success. \n\nOver the last several years, we have been working closely with our hardware\npartners to develop hardware technologies such as Arm Memory Tagging and have\nintroduced Rust in the Android codebase. \n\nThese technologies are going to accelerate our path to memory safety and\nare going to help the wider software industry address a key problem area.\n\n### Memory safety bugs negatively affect quality\n\n\nLatent memory safety bugs can cause non-deterministic results, depending on\nthe state of the system. This unpredictable behavior leads to crashes and\nannoyance for our users.\n\n\nEvery day we observe millions of native crashes from end user devices and\nwith the introduction of [GWP-ASan](https://developer.android.com/ndk/guides/gwp-asan), we have traced the majority of them to memory\nsafety bugs. \nThis data point validates the correlation between quality\nand density of memory safety bugs and is in alignment with what our Chrome\ncolleagues observe (see Chrome [GWP-ASan bug hotlist](https://bugs.chromium.org/p/chromium/issues/list?can=1&q=Hotlist%3DGWP-ASan)).\n\n### Memory safety bugs negatively affect security\n\n\nMemory safety bugs have consistently been the top contributor to Android\nsecurity vulnerabilities, going as far back as the first Android release.\n**Figure 2**: Memory safety bugs contribution to Android vulnerabilities\n\n\nWhile it is encouraging to know that this is not just an Android problem\n(see [Chrome](https://www.chromium.org/Home/chromium-security/memory-safety)\nand [Microsoft](https://msrc-blog.microsoft.com/2019/07/16/a-proactive-approach-to-more-secure-code/)\nstats), we need to do more for the safety of our users. \n\nThe [Project Zero team](https://googleprojectzero.blogspot.com/)\nat Google [tracks](https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/view#gid=0)\nzero day exploits that have been used in real attacks against users as zero day\nvulnerabilities. These are not hypothetical bugs but exploits actively used in\nattacks against users. Memory safety bugs (memory corruption and use-after-free)\ncomprise an overwhelming majority.\n\n### Memory safety bugs increase costs\n\n\nKeeping devices up to date with security fixes keeps our users safe but comes\nwith a monetary cost to our ecosystem.\n\n\nThe high density of memory safety bugs in low level vendor code, which\noften has custom modifications, significantly increases the fix and tests costs.\nHowever, detecting these bugs early during the development cycle can lower these\ncosts.\n\n\n[Research](https://www.researchgate.net/figure/IBM-System-Science-Institute-Relative-Cost-of-Fixing-Defects_fig1_255965523)\nshows that detecting bugs earlier can reduce costs up to six times. However,\ngiven the complexity of our ecosystem, the average number of codebases\nmaintained by a vendor and the ever increasing complexity of software, the\nsavings could be higher.\n\nMemory safety\n-------------\n\n\nStarting with Android 12, we've made systemic\nchanges to reduce the density of memory safety bugs in Android codebases.\nWe are extending the Android memory safety tools and introducing new\nrequirements that encourage our ecosystem to address this category of bugs. Over\ntime, these should translate to higher quality and better security for our users\nand lower costs to our vendors.\n\n\nMemory safety is likely to become a differentiator for quality and security\nin the coming years, and Android plans to lead the way.\n\n### Requirements in support of memory safety\n\n\nThe [Android\nCompatibility Definition Document](/compatibility/android-cdd) (CDD) strongly recommends the use of\nmemory safety tools during development. \n\nWe are working closely with our ecosystem to increase the use of memory\nsafety tools and integrate them in the continuous integration and testing\nprocesses. \n\nOver time, we would like to ensure that each device passes a full\nCompatibility Test Suite ([CTS](/compatibility/cts)) run, using memory\nsafety tools, which demonstrates that no such bugs were found. For example, Arm\nv9 platforms will be required to provide a CTS run with Memory Tagging enabled,\nwhereas Arm v8 platforms will be requested to provide a CTS run using HWASAN and\nKASAN.\n\n### Rust as a new programming language for platform code\n\n\nAndroid 12 introduced [Rust as a platform language](https://security.googleblog.com/2021/04/rust-in-android-platform.html). Rust provides memory and\nthread safety at performance levels similar to C/C++.\nWe expect Rust to be the preferred choice for most new native projects.\nHowever, rewriting all memory unsafe code, currently representing over 70% of\nthe Android platform code, in Rust isn't feasible.\nMoving forward Rust will be complementary to memory safety tools.\n\nMemory safety tools\n-------------------\n\n\nAndroid supports a wide variety of tools that help detect memory safety bugs.\nThe figure below presents a taxonomy of the available Android memory safety\ntools.\n**Figure 3**: Android memory safety tools landscape\n\n\nOur tooling covers a vast range of deployment scenarios and targets. The\nfollowing documentation describes each tool and provides a reference for using\nthem in your products."]]
