바이너리 정적 분석 기반 Out-of-Bounds Read 취약점 유형 탐지 연구
A Out-of-Bounds Read vulnerability Detection Method Based on Binary Static Analysis
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
프로그램에서 취약점이 발생하면 그에 대한 정보가 문서화되어 공개된다. 그러나 일부 취약점의 경우 발생한 원인과 그 소스코드를 공개하지 않는다. 이러한 정보가 없는 상황에서 취약점을 찾기 위해서는 바이너리 수준에서 코드를 분석해야 한다. 본 논문에서는 Out-of-bounds Read 취약점 유형을 바이너리 수준에서 찾는 것을 목표로 한다. 바이너리에서 취약점을 탐지하는 기존의 연구는 주로 동적 분석을 이용한 도구로 발표되었다. 동적 분석의 경우 프로그램 실행 정보를 바탕으로 취약점을 정확하게 탐지할 수 있지만, 모든 실행 경로를 탐지하지 못할 가능성이 있다. 모든 프로그램 경로를 분석하기 위해서는 정적 분석을 사용해야 한다. 기존의 정적 도구의 경우 소스코드 기반의 도구들이며, 바이너리에 수준의 정적 도구는 찾기 어렵다. 본 논문에서는 바이너리 정적 분석을 통해 취약점을 탐지하며, 메모리 구조를 모델링하는 방법으로 Heap, Stack, Global 영역의 취약점을 탐지한다. 실험 결과 기존의 탐지도구인 BAP_toolkit과 비교하였을 때 탐지 정확도 및 분석 시간에서 의미 있는 결과를 얻었다.
Abstract
When a vulnerability occurs in a program, it is documented and published through CVE. However, some vulnerabilities do not disclose the details of the vulnerability and in many cases the source code is not published. In the absence of such information, in order to find a vulnerability, you must find the vulnerability at the binary level. This paper aims to find out-of-bounds read vulnerability that occur very frequently among vulnerability. In this paper, we design a memory area using memory access information appearing in binary code. Out-of-bounds Read vulnerability is detected through the designed memory structure. The proposed tool showed better in code coverage and detection efficiency than the existing tools.
참고문헌 (31)
- "CW E Ranking" (2021)[URL]
- K. Serebryany, "Addresssanitizer: A fast address sanity checker", USENIX Annual Technical Conference, pp.309~318 (2012)
- S. Nagarakatte, "Softbound: Highly compatible and complete spatial memory safety for c", ACM Sigplan Notices, 44(6), pp.245~258 (2009)
- N. Nethercote, "Valgrind: a framework for heavyweight dynamic binary instrumentation", ACM Sigplan notices, 42(6), pp.89~100 (2007), ACM
- S. Nagarakatte, "Cets:compiler enforced temporal safety for c", ACM Sigplan Notices, 45(8), pp.31~40 (2010), ACM
- "cwe_checker github repo, “cwe checker”" (2021)[URL]
- "American fuzzy lop" (2021)[URL]
- C. Lemieux, "Perffuzz: automatically generating pathological inputs", Proceedings of the 27th ACM SIGSOFT International Symposium on Software Testing and Analysis, pp.254~265 (2018), ACM
- C. Lemieux, "Fairfuzz: A targeted mutation strategy for increasing greybox fuzz testing coverage", Proceedings of the 33rd ACM, 2018, 475~485[DOI]
- M. Böhme, "Directed greybox fuzzing", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.2329~2344 (2017), ACM
- M. Böhme, "Coverage-based greybox fuzzing as markov chain", Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp.1032~1043 (2016), ACM
- "bap-toolkit github repo, “BAP Toolkit”" (2021)[URL]
- BRUMLEY, David, "BAP: A binary analysis platform", International Conference on Computer Aided Verification, pp.463~469 (2011), Springer
- "Binary Analysis Platform github repo, “Binary Analysis Platform”" (2021)[URL]
- "AddressSanitizerComparisonOfMemory Tools, “sanitizers”" (2021)[URL]
- A. Filieri, "Reliability analysis in symbolic pathfinder", 2013 35th International Conference on Software Engineering, pp.622~631 (2013), IEEE
- S. Person, "Directed incremental symbolic execution", Acm Sigplan Notices, 46(6), pp.504~515 (2011), ACM
- J. H. Siddiqui, "Staged symbolic execution", Proceedings of the 27th Annual ACM Symposium on Applied Computing, 1339(1346), pp.1339~1346 (2012), ACM
- Y. Li, "Steering symbolic execution to less traveled paths", ACM SigPlan Notices, 48(10), pp.19~32 (2013), ACM
- T. Xie, "Fitness-guided path exploration in dynamic symbolic execution", IEEE, 2009, 359~368
- B. C. Parrino, "Tacoflow : optimizing sat program verification using dataflow analysis", Software & Systems Modeling, 14(1), pp.45~63 (2015)
- C. Cadar, "Klee : Unassisted and automatic generation of high-coverage tests for complex systems programs", USENIX Symposium on Operating Systems Design and Implementation, 8, pp.209~224 (2008)
- W. Visser, "Test input generation with java pathfinder", ACM SIGSOFT Software Engineering Notes, 29(4), pp.97~107 (2004)
- S. Anand, "Jpf–se : A symbolic execution extension to java pathfinder", International Conference on Tools and Algorithms for the Construction and Analysis of Systems, pp.134~138 (2007), Springer
- WANG, Haijun, "Locating vulnerabilities in binaries via memory layout recovering", Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp.718~728 (2019)
- G. Balakrishnan, "Analyzing memory accesses in x86executables", International conference on compiler construction, pp.5~23 (2004), Springer
- J. Lee, "Tie: Principled reverse engineering of types in binary programs" (2011)
- Z. Lin, "Automatic reverse engineering of data structures from binary execution", Proceedings of the 11th Annual Information Security Symposium, pp.1~1 (2010)
- Slowinska, Asia, "Howard: A Dynamic Excavator for Reverse Engineering Data Structures" (2011), NDSS
- "Body armor for binaries: Preventing buffer overflows without recompilation", USENIX Annual Technical Conference, pp.125~137 (2012)
- "Juliet Test Suite" (2021)[URL]