Abstract:Missing a security operation such as a bound check has been a major cause of security-critical bugs. Automatically checking whether the code misses a security operation in large programs is challenging since it has to understand whether the security operation is indeed necessary in the context. Recent methods typically employ cross-checking to identify deviations as security bugs, which collects functionally similar program slices and infers missed security operations through majority-voting. An inherent limitation of such approaches is that they heavily rely on a substantial number of similar code pieces to enable cross-checking. In practice, many code pieces are unique, and thus we may be unable to find adequate similar code snippets to utilize cross-checking. In this paper, we present IPPO (Inconsistent Path Pairs as a bug Oracle), a static analysis framework for detecting security bugs based on differential checking. IPPO defines several novel rules to identify code paths that share similar semantics with respect to an object, and collects them as similar-path pairs. It then investigates the path pairs for identifying inconsistent security operations with respect to the object. If one path in a path pair enforces a security operation while the other does not, IPPO reports it as a potential security bug. By utilizing on object-based path-similarity analysis, IPPO achieves a higher precision, compared to conventional code-similarity analysis methods. Through differential checking of a similar-path pair, IPPO eliminates the requirement of constructing a large number of similar code pieces, addressing the limitation of traditional cross-checking approaches. We implemented IPPO and extensively evaluated it on four widely used open-source programs: Linux kernel, OpenSSL library, FreeBSD kernel, and PHP. IPPO found 154, 5, 1, and 1 new security bugs in the above systems, respectively. We have submitted patches for all these bugs, and 136 of them have been accepted by corresponding maintainers. The results confirm the effectiveness and usefulness of IPPO in practice.

Detecting Missing Checks for Identifying Insufficient Attack Protections

Automatic Detection and Repair Recommendation for Missing Checks

Securing c programs by dynamic type checking

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

Evaluating C/C++ Vulnerability Detectability of Query-Based Static Application Security Testing Tools

SafeCheck: Detecting smart contract vulnerabilities based on static program analysis methods

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

Mvp: Detecting Vulnerabilities Using Patch-Enhanced Vulnerability Signatures

Brick: A Binary Tool For Run-Time Detecting And Locating Integer-Based Vulnerability

LLM-Enhanced Static Analysis for Precise Identification of Vulnerable OSS Versions

Automated software vulnerability detection with machine learning

Detecting Missed Security Operations Through Differential Checking of Object-based Similar Paths.

Detecting security vulnerabilities with vulnerability nets

A Hybrid Approach to Detecting Security Defects in Programs

Patch2QL: Discover Cognate Defects in Open Source Software Supply Chain With Auto-generated Static Analysis Rules

Sharing More and Checking Less: Leveraging Common Input Keywords to Detect Bugs in Embedded Systems.

Method for Automated Detection of Suspicious Vulnerability Related to Numerical Stability

VulMatch: Binary-level Vulnerability Detection Through Signature

Detection of Software Security Weaknesses Using Cross-Language Source Code Representation (CLaSCoRe)

Using type qualifiers to analyze untrusted integers and detecting security flaws in c programs

VCIPR: Vulnerable Code is Identifiable When a Patch is Released (Hacker's Perspective)