Google Online Security Blog
Follow
Bringing Rust to the Pixel Baseband
Google is enhancing Pixel device security, specifically targeting modem vulnerabilities. The project focuses on integrating a memory-safe Rust DNS parser into the modem firmware. This integration aims to mitigate memory-safety vulnerabilities and reduce attack surfaces. The team selected the "hickory-proto" Rust library and enabled "no_std" support for compatibility. The process involved adapting the library and its dependencies for use in a bare-metal environment. Rust code was compiled into a static library and integrated into the existing build system. A performance issue concerning weak symbols during linking was addressed and resolved. FFI was used to expose Rust APIs to C++ for DNS parsing and callbacks. The team employed "cargo-gnaw" for building third-party crates, improving maintainability. This marks the first step towards wider use of memory-safe code within the cellular baseband. The introduction of Rust for DNS parsing enhances the security posture for future Pixel devices. This project sets a strong foundation for future security upgrades.