Detecting API Missing-Check Bugs Through Complete Cross Checking of Erroneous Returns

Qintao Shen,Hongyu Sun,Shangqing Liu,Kai Chen,Yuqing Zhang

DOI: https://doi.org/10.1007/978-3-031-26553-2_21

2023-01-01

Abstract:Missing-check of erroneous execution states may cause critical security problems, such as null pointer dereference bugs or logic errors, which could even crash the systems. It’s still a challenge to decide automatically whether an erroneous state should be validated or not because of the difficulty in understanding API semantics. Cross-checking is a sound method to resolve the problem. However, recent cross-checking studies suffer from poor accuracy due to inaccurate data-flow analysis, leading to the imprecise analysis of many error states and false positives. In this paper, we present ERSAnalyzer (Erroneous Return Status Analyzer), a new static analysis method to improve existing tools to completely detect inter-procedural missing-check bugs of return values in the Linux kernel. At first, our approach identifies the functions which may generate error return status. After that, we propose a new method to find out the pointer parameter variables carrying error semantics except for the return values. Then a complete missing-check analysis on these critical variables is performed to confirm if they are validated before or after functions return. By utilizing cross-checking, ERSAnalyzer achieves higher precision of 71.3% in deciding whether a critical variable is checked. ERSAnalyzer reports 335 cases; 239 of those are potential bugs, 25 are manually proved to be actual missing-check bugs. Limited by the understanding of the code logic and some bugs that have been fixed in the latest version. We finally submitted 12 new bugs to the Linux Kernel, and six of our patches have been accepted up to now. The results show the effectiveness of ERSAnalyzer.