Abstract
Although Rust ensures memory safety by default, it also permits the use ofunsafe code, which can introduce memory safety vulnerabilities if misused.Unfortunately, existing tools for detecting memory bugs in Rust typicallyexhibit limited detection capabilities, inadequately handle Rust-specifictypes, or rely heavily on manual intervention. To address these limitations, we present deepSURF, a tool that integratesstatic analysis with Large Language Model (LLM)-guided fuzzing harnessgeneration to effectively identify memory safety vulnerabilities in Rustlibraries, specifically targeting unsafe code. deepSURF introduces a novelapproach for handling generics by substituting them with custom types andgenerating tailored implementations for the required traits, enabling thefuzzer to simulate user-defined behaviors within the fuzzed library.Additionally, deepSURF employs LLMs to augment fuzzing harnesses dynamically,facilitating exploration of complex API interactions and significantlyincreasing the likelihood of exposing memory safety vulnerabilities. Weevaluated deepSURF on 27 real-world Rust crates, successfully rediscovering 20known memory safety bugs and uncovering 6 previously unknown vulnerabilities,demonstrating clear improvements over state-of-the-art tools.