Detecting Vulnerabilities in Linux-Based Embedded Firmware with SSE-Based On-Demand Alias Analysis
Detecting Vulnerabilities in Linux-Based Embedded Firmware with SSE-Based On-Demand Alias Analysis
复制标题
DOI：
10.1145/3597926.3598062
复制
发表时间：
2023-07
期刊：
影响因子：
--
通讯作者：
Kai Cheng;Yaowen Zheng;Tao Liu;Le Guan;Peng Liu;Hong Li;Hongsong Zhu;Kejiang Ye;Limin Sun
中科院分区：
文献类型：
--
作者：
Kai Cheng;Yaowen Zheng;Tao Liu;Le Guan;Peng Liu;Hong Li;Hongsong Zhu;Kejiang Ye;Limin Sun
虽然使用静态污点分析来检测基于Linux的嵌入式固件中污点风格的漏洞的重要性得到了广泛的认可，但现有的方法受到以下主要限制的困扰：(A)现有的工作不能正确地处理从攻击者控制的信源到安全敏感信宿的路径上的间接调用，导致大量的漏报。(B)他们使用启发式方法来识别中间污染源，但不够准确，导致较高的假阳性。为了解决这些问题，我们提出了一种新的静态方法EmTaint，用于准确快速地检测基于Linux的嵌入式固件中的污点风格漏洞。在EmTaint中，我们首先设计了一种基于结构化符号表达式(SSE)的按需别名分析技术。在此基础上，提出了间接呼叫解析和精确污点分析方案。结合清理规则检查，EmTaint最终可以在有限的时间内准确发现大量污秽风格的漏洞。我们对EmTaint与来自六家流行供应商的35个真实嵌入式固件样本进行了评估。结果表明，EmTaint发现了至少192个漏洞，其中n天漏洞41个，0天漏洞151个。在撰写本文时，已从报告漏洞的子集中分配了至少115个CVE/PSV编号。与KARONTE和SATC等最先进的工具相比，EmTaint在更短的时间内发现了同一数据集上更多的漏洞。
Although the importance of using static taint analysis to detect taint-style vulnerabilities in Linux-based embedded firmware is widely recognized, existing approaches are plagued by following major limitations: (a) Existing works cannot properly handle indirect call on the path from attacker-controlled sources to security-sensitive sinks, resulting in lots of false negatives. (b) They employ heuristics to identify mediate taint source and it is not accurate enough, which leads to high false positives. To address issues, we propose EmTaint, a novel static approach for accurate and fast detection of taint-style vulnerabilities in Linux-based embedded firmware. In EmTaint, we first design a structured symbolic expression-based (SSE-based) on-demand alias analysis technique. Based on it, we come up with indirect call resolution and accurate taint analysis scheme. Combined with sanitization rule checking, EmTaint can eventually discovers a large number of taint-style vulnerabilities accurately within a limited time. We evaluated EmTaint against 35 real-world embedded firmware samples from six popular vendors. The result shows EmTaint discovered at least 192 vulnerabilities, including 41 n-day vulnerabilities and 151 0-day vulnerabilities. At least 115 CVE/PSV numbers have been allocated from a subset of the reported vulnerabilities at the time of writing. Compared with state-of-the-art tools such as KARONTE and SaTC, EmTaint found significantly more vulnerabilities on the same dataset in less time.