동적 기호 실행을 이용한 윈도우 시스템 콜 Use-After-Free 취약점 자동 탐지 방법
Automated Method for Detecting Use-After-Free Vulnerability of Windows System Calls Using Dynamic Symbolic Execution
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 소프트웨어 산업의 발달에 따른 사회적 보안 문제가 지속적으로 발생하고 있으며, 소프트웨어 안정성 검증을 위해 다양한 자동화 기법들이 사용되고 있다. 본 논문에서는 소프트웨어 테스팅 기법 중 하나인 동적 기호 실행을 이용해윈도우 시스템 콜 함수를 대상으로 Use-After-Free 취약점을 자동으로 탐지하는 방법을 제안한다. 먼저, 목표 지점을 선정하기 위한 정적 분석 기반 패턴 탐색을 수행한다. 탐지된 패턴 지점을 바탕으로 관심 밖의 영역으로의 분기를차단하는 유도된 경로 탐색 기법을 적용한다. 이를 통해 기존 동적 기호 실행 기술의 한계점을 극복하고, 실제 목표 지점에서의 취약점 발생 여부를 검증한다. 제안한 방법을 실험한 결과 기존에 수동으로 분석해야 했던 Use-After-Free 취약점을 제안한 자동화 기법으로 탐지할 수 있음을 확인하였다.
Abstract
Recently, social security problems have been caused by the development of the software industry, and a variety of automation techniques have been used to verify software stability. In this paper, we propose a method of automatically detecting a use-after-free vulnerability on Windows system calls using dynamic symbolic execution, one of the software testing methods. First, a static analysis based pattern search is performed to select a target point. Based on the detected pattern points, we apply an induced path search technique that blocks branching to areas outside of interest. Through this, we overcome limitations of existing dynamic symbolic performance technology and verify whether vulnerability exists at actual target point. As a result of applying the proposed method to the Windows system call, it is confirmed that the use-after-free vulnerability, which had previously to be manually analyzed, can be detected by the proposed automation technique.
참고문헌 (25)
- "Software Industry Annual Report" (2015)[URL]
- "National Vulnerability Database : Statistics Results Page" (2017)[URL]
- J Feist, "Statically detecting use after free on binary code", Springer, 10 (2014)
- J. Caballero, "Undangle:Early Detection of Dangling Pointers in Use-after-free and Double-free Vulnerabilities", ISSTA (2012)
- B Lee, "Preventing Use-after-free with Dangling Pointers Nullification", NDSS (2015)
- James C. King, "Symbolic Execution and Program Testing", Communications of the ACM, 19(7) (1976)
- Cadar C, "EXE:Automatically generating inputs of death", Computer Andcommunications Security, 12(2), pp.3296~3306 (2006)
- Cadar C, "KLEE:Unassisted and automatic generation of high-coverage tests for complex systems programs" (2008), USENIX
- D Babic, "Statically-Directed Dynamic Automated Test Generation", Proceedings of the ACM, 2011, ~
- E. Bounimova, "Billions and Billions of Constraints: Whitebox Fuzz Testing in Production" (2013), IEEE
- Vitaly Chipounov, "S2E : A Platform for In Vivo Multi-Path Analysis of Software Systems", 16th Intl. ASPLOS (2011)
- "dslab-epfl/s2e"[URL]
- "S2E Developer Forum"[URL]
- VT Pham, "Hercules : Reproducing Crashes in Real-World Application Binaries" (2015), ACM
- C Yeh, "CRAXDroid : Automatic android system testing by selective symbolic execution", 8th International Conference on Software Security and Reliability (2014)
- N Stephens, "Driller : Augmenting Fuzzing Through Selective Symbolic Execution" (2016), Internetsociety
- B Zhang, "Detecting integer overflow in Windows binary executables based on symbolic execution", IEEE, 2016, ~
- Yu Wang, "A New CVE-2015-0057 Exploit Technology" (2015), BlackHat
- Exploiting the wi n3 2 k ! x x x E n a b leWndSBA r r o ws use-after-free(CVE-2015-0057)bug on both 32-bit and 64-bit, "Aaron Adams", An NCC Group Publication, ~ (2015)
- Dominic Wang, "Exploiting MS15-061Microsoft Windows Kernel Use-After-Free(win32!xxxSetClassLong)" (2015), nccgroup
- "Class Dismissed: 4 Use-After-Free Vulnerabilities in Windows" (2015)[URL]
- Tarjei Mandt, "Kernel Attacks through User-Mode Callbacks" (2011), BlackHat
- Godefroid, Patrice, "DART : directed automated random testing", ACM Sigplan Notices, 40(6) (2005), ACM
- Sen, Koushik, "CUTE : a concolic unit testing engine for C", ACM SIGSOFT Software Engineering Notes, 30(5) (2005), ACM
- Kunal Taneja, "Guided Path Exploration for Regression Test Generation", ICSE Companion (2009)