Abstract:Integer-Overflow-to-Buffer-Overflow ( IO2BO ) vulnerabilities can be exploited by attackers to cause severe damages to computer systems. In this paper, we present the design and implementation of IntTracker, an efficient dynamic tracking technique for detecting IO2BO vulnerabilities in C/C++ programs. IntTracker utilizes a static taint analysis to select potential overflow sites that are integer operations along critical paths, from sources that are program points reading values from users, to sinks that are memory allocation sites. It then instruments overflow checks at the selected sites. Instead of producing warnings once integer overflows occur, IntTracker replaces the overflown value with a very large and rarely used integer value ( dirty value), and treats such the value as an overflow tag. Tag propagation is performed by the existing program operations without any instrumentation as operations on dirty values often produce dirty values. Propagation can be automatically cut off by sanitization routines as they could prevent dirty values from affecting further program execution. IntTracker monitors whether any dirty value is used at a sink to detect IO2BO vulnerabilities. We evaluate IntTracker on 3444 programs of the NIST's SAMATE reference dataset, the SPEC CINT2000 benchmarks and 34 IO2BO bugs in real world. The experimental results show that IntTracker is effective in detecting harmful IO2BO vulnerabilities while bypassing false positives introduced by sanitization routines. Meanwhile, the runtime overhead is negligible, averaging about 0.69%. In contrast, IntPatch, the state of the art, produces a lot more false positives and has a higher overhead.

Identify Stack Overflow Exploits with Dynamic Binary Instrumentation

Staticly Detect Stack Overflow Vulnerabilities with Taint Analysis

Dynamic Binary Instrumentation Based Defense Solution Against Virtual Function Table Hijacking Attacks at C++ Binary Programs.

SafeStack: Automatically Patching Stack-Based Buffer Overflow Vulnerabilities

Dynamic Stack Buffer-overflow Prevention Based on Return-address Translation

Detecting Integer Overflow Vulnerabilities in Binary Executables Based on Target Filtering and Dynamic Taint Tracing

BofAEG: Automated Stack Buffer Overflow Vulnerability Detection and Exploit Generation Based on Symbolic Execution and Dynamic Analysis

Active Checking Buffer Overflow Vulnerability In Binaries With Symbolic Execution

IntScope: Automatically Detecting Integer Overflow Vulnerability in X86 Binary Using Symbolic Execution.

Dynamic Detection of Buffer-overflow Vulnerabilities in Binary Environment

To Detect Stack Buffer Overflow with Polymorphic Canaries

Detecting Privilege Escalation Attacks through Instrumenting Web Application Source Code.

Dynamic Analysis and Debugging of Binary Code for Security Applications

Stack Buffer Overflow Prevention Based on Dual-stack

An Enhancement of Return Address Stack for Security

Efficient Dynamic Tracking Technique for Detecting Integer-Overflow-to-Buffer-Overflow Vulnerability.

Dynamic Stack Buffer Overflow Prevention Based on Protection of Control-Flow Data

STACKEEPER: A Static Source Code Analyzer to Detect Stack-based Uninitialized Use Vulnerabilities

OFFDTAN: A New Approach of Offline Dynamic Taint Analysis for Binaries

Deobfuscate Non-Returning Calls and Call-Stack Tampering in Instruction Traces

The Study on Integer Overflow Vulnerability Detection in Binary Executables Based Upon Genetic Algorithm