Abstract:To reduce the development costs, IoT vendors tend to construct IoT kernels by customizing the Linux kernel. Code pruning is common in this customization process. However, due to the intrinsic complexity of the Linux kernel and the lack of long-term effective maintenance, IoT vendors may mistakenly delete necessary security operations in the pruning process, which leads to various bugs such as memory leakage and NULL pointer dereference. Yet detecting bugs caused by code pruning in IoT kernels is difficult. Specifically, (1) a significant structural change makes precisely locating the deleted security operations (DSO ) difficult, and (2) inferring the security impact of a DSO is not trivial since it requires complex semantic understanding, including the developing logic and the context of the corresponding IoT kernel. In this paper, we present CPscan, a system for automatically detecting bugs caused by code pruning in IoT kernels. First, using a new graph-based approach that iteratively conducts a structure-aware basic block matching, CPscan can precisely and efficiently identify theDSOs in IoT kernels. Then, CPscan infers the security impact of a DSO by comparing the bounded use chains (where and how a variable is used within potentially influenced code segments) of the security-critical variable associated with it. Specifically, CPscan reports the deletion of a security operation as vulnerable if the bounded use chain of the associated security-critical variable remains the same before and after the deletion. This is because the unchanged uses of a security-critical variable likely need the security operation, and removing it may have security impacts. The experimental results on 28 IoT kernels from 10 popular IoT vendors show that CPscan is able to identify 3,193DSO s and detect 114 new bugs with a reasonably low false-positive rate. Many such bugs tend to have a long latent period (up to 9 years and 5 months). We believe CPscan paves a way for eliminating the bugs introduced by code pruning in IoT kernels. We will open-source CPscan to facilitate further research.

Effective Detection of Sleep-in-atomic-context Bugs in the Linux Kernel.

Dsac: Effective Static Analysis Of Sleep-In-Atomic-Context Bugs In Kernel Modules

Effective Detection of Sleep-in-atomic-context Bugs in the Linux Kernel

DCNS: Automated Detection Of Conservative Non-Sleep Defects in the Linux Kernel

Detecting DBMS Bugs with Context-Sensitive Instantiation and Multi-Plan Execution

When Top-down Meets Bottom-up: Detecting and Exploiting Use-After-Cleanup Bugs in Linux Kernel

Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking

Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers

CPscan: Detecting Bugs Caused by Code Pruning in IoT Kernels

InsectACIDE: Debugger-Based Holistic Asynchronous CFI for Embedded System

DLOS: Effective Static Detection of Deadlocks in OS Kernels

UBITect: a precise and scalable method to detect use-before-initialization bugs in Linux kernel

Understanding Concurrency Vulnerabilities in Linux Kernel

Detecting Atomicity Violations in Interrupt-Driven Programs Via Interruption Points Selecting and Delayed ISR-Triggering

Path-sensitive and Alias-Aware Typestate Analysis for Detecting OS Bugs

MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels

Finding Missing Security Operation Bugs via Program Slicing and Differential Check.

SaTC: Shared-Keyword Aware Taint Checking for Detecting Bugs in Embedded Systems

SATIN: A Secure and Trustworthy Asynchronous Introspection on Multi-Core ARM Processors

Enhancing Static Analysis for Practical Bug Detection: An LLM-Integrated Approach

Detecting Atomicity Violations for Interrupt-driven Programs Via Systematic Scheduling and Prefix-directed Feedback