Abstract:With a growing demand of concurrent software to exploit multi-core hardware capability, concurrency vulnerabilities have become an inevitable threat to the security of today's IT industry. Existing concurrent program detection schemes focus mainly on detecting concurrency errors such as data races, atomicity violation, etc., with little attention paid to detect concurrency vulnerabilities that may be exploited to infringe security. In this paper, we propose a heuristic framework that combines both static analysis and fuzz testing to detect targeted concurrency vulnerabilities such as concurrency buffer overflow, double free, and use-after-free. The static analysis locates sensitive concurrent operations in a concurrent program, categorizes each finding into a potential type of concurrency vulnerability, and determines the execution order of the sensitive operations in each finding that would trigger the suspected concurrency vulnerability. The results are then plugged into the fuzzer with the execution order fixed by the static analysis in order to trigger the suspected concurrency vulnerabilities. In order to introduce more variance which increases possibility that the concurrency errors can be triggered, we also propose manipulation of thread scheduling priority to enable a fuzzer such as AFL to effectively explore thread interleavings in testing a concurrent program. To the best of our knowledge, this is the first fuzzer that is capable of effectively exploring concurrency errors. In evaluating the proposed heuristic framework with a benchmark suit of six real-world concurrent C programs, the framework detected two concurrency vulnerabilities for the proposed concurrency vulnerability detection, both being confirmed to be true positives, and produced three new crashes for the proposed interleaving exploring fuzzer that existing fuzzers could not produce. These results demonstrate the power and effectiveness of the proposed heuristic framework in detecting concurrency errors and vulnerabilities.

Detecting Atomicity Violations in Interrupt-Driven Programs Via Interruption Points Selecting and Delayed ISR-Triggering

Detecting Atomicity Violations for Interrupt-driven Programs Via Systematic Scheduling and Prefix-directed Feedback

Detect Atomicity Violations in Concurrent Programs Through User Assistance and Identification of Suspicious Variable Access Patterns

Bounded Verification of Atomicity Violations for Interrupt-Driven Programs Via Lazy Sequentialization

Program Verification Enhanced Precise Analysis of Interrupt-Driven Program Vulnerabilities

AVPredictor: Comprehensive Prediction and Detection of Atomicity Violations

Detecting Data Races in Interrupt-Driven Programs based on Static Analysis and Dynamic Simulation

A Lightweight System for Detecting and Tolerating Concurrency Bugs

On atomicity enforcement in concurrent software via Discrete Event Systems theory

Data Race and Atomicity Checking for C Programs with Multiple Interruptions

Verifying Synchronization for Atomicity Violation Fixing

Easy Modelling and Verification of Unpredictable and Preemptive Interrupt-Driven Systems

Automatic Detection, Validation and Repair of Race Conditions in Interrupt-Driven Embedded Software

A Heuristic Framework to Detect Concurrency Vulnerabilities.

PIChecker: A POR and Interpolation Based Verifier for Concurrent Programs (competition Contribution)

Efficient Data Race Detection for Interrupt-Driven Programs Via Path Feasibility Analysis

Rchecker: A CBMC-based Data Race Detector for Interrupt-driven Programs

Data Race Detection for Interrupt-Driven Programs via Bounded Model Checking

Certifying Low-Level Programs with Hardware Interrupts and Preemptive Threads

BAVC: Classifying Benign Atomicity Violations Via Machine Learning

Effective Detection of Sleep-in-atomic-context Bugs in the Linux Kernel.