Abstract:Security bugs like memory errors are constantly introduced to software programs, and recent years have witnessed an increasing number of reported security bugs. Traditional detection approaches are mainly specification-based---detecting violations against a specified rule as security bugs. This often does not work well in practice because specifications are difficult to specify and generalize, leaving complicated and new types of bugs undetected. Recent research thus leans toward deviation-based detection which finds a substantial number of similar cases and detects deviating cases as potential bugs. This, however, suffers from two other problems. First, it requires enough similar cases to find deviations and thus cannot work for custom code that does not have similar cases. Second, code-similarity analysis is probabilistic and challenging, so the detection can be unreliable. Sometimes, similar cases can normally have deviating behaviors under different contexts. In this paper, we propose a novel approach for detecting security bugs based on a new concept called Non-Distinguishable Inconsistencies (NDI). The insight is that if two code paths in a function exhibit inconsistent security states (such as being freed or initialized) that are non-distinguishable from the external, such as the callers, there is no way to recover from the inconsistency from the external, which results in a bug. Such an approach has several strengths. First, it is specification-free and thus can support complicated and new types of bugs. Second, it does not require similar cases and by its nature is deterministic. Third, the analysis is practical by minimizing complicated and lengthy data-flow analysis. We implemented NDI and applied it to well-tested programs, including the OpenSSL library, the FreeBSD kernel, the Apache httpd server, and the PHP interpreter. The results show that NDI works for both large and small programs, and it effectively found 51 new bugs, most of which are otherwise missed by the state-of-the-art detection tools.

IntFinder: automatically detecting integer bugs in x86 binary program

Detecting Integer Bugs Based on Static and Dynamic Program Analysis

Automatic Integer Error Repair by Proper-Type Inference

IntScope: Automatically Detecting Integer Overflow Vulnerability in X86 Binary Using Symbolic Execution.

Efficient Dynamic Tracking Technique for Detecting Integer-Overflow-to-Buffer-Overflow Vulnerability.

Brick: A Binary Tool For Run-Time Detecting And Locating Integer-Based Vulnerability

IntPTI: Automatic Integer Error Repair with Proper-Type Inference

Automatic Fix for C Integer Errors by Precision Improvement

High-Trusted-Software-Oriented Automatic Testing for Integer Overflow Bugs

Intpatch: Automatically Fix Integer-Overflow-To-Buffer-Overflow Vulnerability At Compile-Time

Inteq: Recognizing Benign Integer Overflows Via Equivalence Checking Across Multiple Precisions

Using Type Analysis in Compiler to Mitigate Integer-Overflow-to-buffer-overflow Threat

IntRepair: Informed Repairing of Integer Overflows

Improving the Accuracy of Integer Signedness Error Detection Using Data Flow Analysis

FREEWILL: Automatically Diagnosing Use-after-free Bugs via Reference Miscounting Detection on Binaries

UBITect: a precise and scalable method to detect use-before-initialization bugs in Linux kernel

Non-Distinguishable Inconsistencies As a Deterministic Oracle for Detecting Security Bugs.

Using type qualifiers to analyze untrusted integers and detecting security flaws in c programs

A High-Coverage and Efficient Instruction-Level Testing Approach for X86 Processors

RID: Finding Reference Count Bugs with Inconsistent Path Pair Checking.

Tolerating C Integer Error Via Precision Elevation