효율적 데이터 의존성 분석을 이용한 바이너리 기반 Null Pointer Dereference 취약점 탐지 도구
Efficient Null Pointer Dereference Vulnerability Detection by Data Dependency Analysis on Binary
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
널 포인터 역참조 (Null Pointer Dereference) 취약점은 정상적인 메모리 주소를 저장한 포인터가 아닌 널 포인터를 참조할 때 발생하는 취약점이다. 그러므로, 서비스거부공격 (Denial-of-service)와 같은 공격에 악용되어 큰 피해를 줄 수 있기 때문에 식별하고 제거해야 할 중요한 취약점이다. 기존 연구에서는 기호실행과 같은 정적분석을 통해 취약점을 탐지하는 방법을 많이 제안하였다. 그러나 커널과 같은 복잡도가 높은 대형 프로그램을 검사할 때는 경로폭발 (path explosion)과 제약조건(constraint solver) 때문에 효율성이 제한되며 주어진 시간 내에 탐지하지 못할 수 있다. 또는 대형 프로그램 중 일부 함수들 혹은 라이브러리 함수를 탐지할 때 전체 프로그램의 상태를 알 수 없기 때문에 완전한 분석을 수행하지 못해 정확도가 높지 않은 경우가 있다. 본 논문에서는 소스코드가 없는 대규모 프로그램에서 특정한 일부 기능 검사 할 때 빠르고 정확하게 검사하기 위한 가벼운 취약점 탐지도구를 연구개발 하였다. 변수나 포인터를 기호로 표시하고 프로그램 실행을 에뮬레이션하여, 각 실행경로에서 데이터 의존성(data dependency) 분석과 휴리스틱 방법으로 널 포인터 역참조 취약점을 탐지한다. 기존 bap_toolkit과 실험하여 비교하였을 때 오탐율이 8% 높지만, 존재하는 취약점을 모두 탐지해냈다.
Abstract
The Null Pointer Dereference vulnerability is a significant vulnerability that can cause severe attacks such as denial-of-service. Previous research has proposed methods for detecting vulnerabilities, but large and complex programs pose a challenge to their efficiency. In this paper, we present a lightweight tool for detecting specific functions in large binary programs through symbolizing variables and emulating program execution. The tool detects vulnerabilities through data dependency analysis and heuristics in each execution path. While our tool had an 8% higher false positive rate than the bap_toolkit, it detected all existing vulnerabilities in our dataset.
참고문헌 (28)
- "CWEtop25 2021" (2021)[URL]
- Thompson, Ken, "Reflections on trusting trust", Communications of the ACM, 27(8) (1984)
- Shoshitaishvili, Yan, "Sok : (state of)the art of war : Offensive techniques in binary analysis", Proceedings of the 2016 IEEE symposium on security and privacy(S&P), pp.138~157 (2016)
- Li, Yuekang, "Cerebro : context-aware adaptive fuzzing for effective vulnerability detection", Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp.533~544 (2019)
- Peng, Hui, "T-Fuzz : fuzzing by program transformation", Proceedings of the 2018 IEEE Symposium on Security and Privacy(S&P), pp.697~710 (2018)
- Chen, Chen, "A systematic review of fuzzing techniques", Journal of Computers & Security, 75, pp.118~137 (2018)
- Gan, Shuitao, "Collafl : Path sensitive fuzzing", Proceedings of the 2018 IEEE Symposium on Security and Privacy (S&P), pp.679~696 (2018)
- Fioraldi, Andrea, "{AFL++} : Combining Incremental Steps of Fuzzing Research", Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT 20), pp.10~10 (2020)
- A. Filieri, "Reliability analysis insymbolic pathfinder", Proceedings of the 35th International Conference on Software Engineering(ICSE), pp.622~631 (2013)
- J. H. Siddiqui, "Staged symbolic execution", Proceedings of the 27th Annual ACM Symposium on Applied Computng, pp.1339~1346 (2012)
- Wang, Tielei, "IntScope : Automatically Detecting Integer Overflow Vulnerabilityf in X86 Binary Using Symbolic Execution", Proceedings of the Network and Distributed System Security Symposium (NDSS) (2009)
- Davidson, Drew, "{FIE} on firmware : Finding vulnerabilities in embedded systems using symbolic execution", Proceedings of the 22nd USENIX Security Symposium (USENIX Security 13) (2013)
- Yao, Fan, "Statsym : vulnerable path discovery through statistics-guided symbolic execution", Proceedings of the 47th Annual IEEE, 2017, 109~120
- Li, Hongzhe, "Software vulnerability detection using backward trace analysis and symbolic execution", Proceedings of the International Conference on Availability, Reliability and Security, pp.446~454 (2013)
- Luo, Lannan, "System service call-oriented symbolic execution of android framework with applications to vulnerability discovery and exploit generation", Proceedings of the 15th Annual International Conference on Mobile Systems, Applications, and Services, pp.225~238 (2017)
- Chen, Ting, "State of the art : Dynamic symbolic execution for automated test generation", Journal of Future Generation Computer Systems, 29(7), pp.1758~1773 (2013)
- Schwartz, Edward J., "All you ever wanted to know about dynamic taint analysis and forward symbolic execution(but might have been afraid to ask)", Proceedings of the IEEE symposium on Security and privacy(S&P), pp.317~331 (2010)
- Ruaro, Nicola, "SyML : Guiding symbolic execution toward vulnerable states through pattern learning", Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses, pp.456~468 (2021)
- Cheng, Kai, "DTaint : detecting the taint-style vulnerability in embedded device firmware", Proceedings of the 48th Annual IEEE, 2018, 430~441
- Wang, Tielei, "TaintScope : A checksum-aware directed fuzzing tool for automatic software vulnerability detection", Proceedings of the IEEE Symposium on Security and Privacy(S&P), pp.497~512 (2010)
- "CVE-2017-5668"[URL]
- "libpurple"[URL]
- Brumley, David, "BAP : A binary analysis platform", Proceedings of the International Conference on Computer Aided Verification, pp.463~469 (2011)
- "IDA Pro"[URL]
- "AFL Fuzzer"[URL]
- Nethercote, Nicholas, "Valgrind : a framework for heavyweight dynamic binary instrum entation", Jounral of the ACM Sigplan notices, 42(6), pp.89~100 (2007)
- Gotovchits, Ivan, "Saluki : finding taint-style vulnerabilities with static property checking", Proceedings of the NDSS Workshop on Binary Analysis Research (2018)
- Ma, Sen, "Practical null pointer dereference detection via value-dependence analysis", Proceedings of the IEEE International Symposium on Software Reliability Engineering Workshops(ISSREW), pp.70~77 (2015)