Abstract:Memory corruption is a serious class of software vulnerabilities, which requires careful attention to be detected and removed from applications before getting exploited and harming the system users. Symbolic execution is a well-known method for analyzing programs and detecting various vulnerabilities, e.g., memory corruption. Although this method is sound and complete in theory, it faces some challenges, such as path explosion, when applied to real-world complex programs. In this paper, we present a method for improving the efficiency of symbolic execution and detecting four classes of memory corruption vulnerabilities in executable codes, i.e., heap-based buffer overflow, stack-based buffer overflow, use-after-free, and double-free. We perform symbolic execution only on test units rather than the whole program to avoid path explosion. In our method, test units are considered parts of the program's code, which might contain vulnerable statements and are statically identified based on the specifications of memory corruption vulnerabilities. Then, each test unit is symbolically executed to calculate path and vulnerability constraints of each statement of the unit, which determine the conditions on unit input data for executing that statement or activating vulnerabilities in it, respectively. Solving these constraints gives us input values for the test unit, which execute the desired statements and reveal vulnerabilities in them. Finally, we use machine learning to approximate the correlation between system and unit input data. Thereby, we generate system inputs that enter the program, reach vulnerable instructions in the desired test unit, and reveal vulnerabilities in them. This method is implemented as a plugin for angr framework and evaluated using a group of benchmark programs. The experiments show its superiority over similar tools in accuracy and performance.

Memory corruption exploit diagnosis based on field integrity

Reversing and Identifying Overwritten Data Structures for Memory-Corruption Exploit Diagnosis

deExploit: Identifying misuses of input data to diagnose memory-corruption exploits at the binary level.

Learning Fine-Grained Structured Input for Memory Corruption Detection

An Effective Taint‐based Software Vulnerability Miner

Memory-related Vulnerabilities Localization Technology Based on Dynamic Tainting

Capturing Invalid Input Manipulations for Memory Corruption Diagnosis

Memory analysis method and device based on dynamic taint analysis

Identifying exploitable memory objects for out‐of‐bound write vulnerabilities

Field-sensitive Data Flow Integrity

Locating Vulnerabilities in Binaries Via Memory Layout Recovering

TMAC: Taint-based memory protection via access control

A unit-based symbolic execution method for detecting memory corruption vulnerabilities in executable codes

Memory Integrity Techniques for Memory-Unsafe Languages: A Survey

Automated Use-After-Free Detection and Exploit Mitigation: How Far Have We Gone

Dynamic Memory Testing Based on Source Code Instrumentation on Linux Platform

Detection, exploitation and mitigation of memory errors

Data-flow Bending: on the Effectiveness of Data-Flow Integrity.

A Memory Integrity Protection Method Based on Bloom Filter

Detect Use-after-free Vulnerabilities in Binaries

Memory Detecting Method for Access Errors Inside Kernel Modules