Abstract:Integer overflow (IO) vulnerabilities can be exploited by attackers to compromise computer systems. In the mean time, IOs can be used intentionally by programmers for benign purposes such as hashing and random number generation. Hence, differentiating exploitable and harmful IOs from intentional and benign ones is an important challenge. It allows reducing the number of false positives produced by IO vulnerability detection techniques, helping developers or security analysts to focus on fixing critical IOs without inspecting the numerous false alarms. The difficulty of recognizing benign IOs mainly lies in inferring the intent of programmers from source code.In this paper, we present a novel technique to recognize benign IOs via equivalence checking across multiple precisions. We determine if an IO is benign by comparing the effects of an overflowed integer arithmetic operation in the actual world (with limited precision) and the same operation in the ideal world (with sufficient precision to evade the IO). Specifically, we first extract the data flow path from the overflowed integer arithmetic operation to a security related program point (i.e., sink) and then create a new version of the path using more precise types with sufficient bits to represent integers so that the IO can be avoided. Using theorem proving we check whether these two versions are equivalent, that is, if they yield the same values at the sink under all possible inputs. If so, the IO is benign. We implement a prototype, named IntEQ, based on the GCC compiler and the Z3 solver, and evaluate it using 26 harmful IO vulnerabilities from 20 real-world programs, and 444 benign IOs from SPECINT 2000, SPECINT 2006, and 7 real-world applications. The experimental results show that IntEQ does not misclassify any harmful IO bugs (no false negatives) and recognizes 355 out of 444 (about 79.95%) benign IOs, whereas the state of the art can only recognize 19 benign IOs.

SMT Solvers for Integer Overflows

Dynamic and static analyses of integer overflow vulnerabilities

IntScope: Automatically Detecting Integer Overflow Vulnerability in X86 Binary Using Symbolic Execution.

Research on Integer-Based Vulnerabilities：Security Model, Detecting Methods and Real- World Cases

Detecting Critical Bugs in SMT Solvers Using Blackbox Mutational Fuzzing

Inteq: Recognizing Benign Integer Overflows Via Equivalence Checking Across Multiple Precisions

Detecting Buffer-Overflow Vulnerabilities in Smart Grid Devices via Automatic Static Analysis

Validating SMT Solvers Via Skeleton Enumeration Empowered by Historical Bug-Triggering Inputs.

Using Type Analysis in Compiler to Mitigate Integer-Overflow-to-buffer-overflow Threat

Automated Verification of Integer Overflow

SMT Solver Validation Empowered by Large Pre-Trained Language Models.

High-Trusted-Software-Oriented Automatic Testing for Integer Overflow Bugs

Control Flow-Guided SMT Solving for Program Verification

Efficient Dynamic Tracking Technique for Detecting Integer-Overflow-to-Buffer-Overflow Vulnerability.

Leveraging Control Flow Knowledge in SMT Solving of Program Verification

Intpatch: Automatically Fix Integer-Overflow-To-Buffer-Overflow Vulnerability At Compile-Time

Using type qualifiers to analyze untrusted integers and detecting security flaws in c programs

Z3: An Efficient SMT Solver

Satisfiability Modulo Exponential Integer Arithmetic

Demystifying Performance Regressions in String Solvers

Towards Efficient Heap Overflow Discovery