Detecting Missed Security Operations Through Differential Checking of Object-based Similar Paths
Detecting Missed Security Operations Through Differential Checking of Object-based Similar Paths
复制标题
DOI：
10.1145/3460120.3485373
复制
发表时间：
2021-11
期刊：
影响因子：
--
通讯作者：
Dinghao Liu;Qiushi Wu;S. Ji;Kangjie Lu;Zhenguang Liu;Jianhai Chen;Qinming He
中科院分区：
文献类型：
--
作者：
Dinghao Liu;Qiushi Wu;S. Ji;Kangjie Lu;Zhenguang Liu;Jianhai Chen;Qinming He
缺少安全操作（如边界检查）是导致安全关键错误的主要原因。在大型程序中自动检查代码是否错过安全操作是一项挑战，因为它必须了解安全操作在上下文中是否确实必要。最近的方法通常采用交叉检查来将偏差识别为安全漏洞，该方法收集功能相似的程序片段，并通过多数投票推断错过的安全操作。这种方法的一个固有限制是，它们严重依赖于大量类似的代码片段来实现交叉检查。在实践中，许多代码片段是唯一的，因此我们可能无法找到足够的类似代码片段来进行交叉检查。在本文中，我们提出了IPPO（不一致的路径对作为一个错误Oracle），一个静态分析框架，用于检测基于差分检查的安全漏洞。IPPO定义了几个新的规则来识别共享类似对象语义的代码路径，并将它们收集为类似路径对。然后，它调查的路径对识别不一致的安全操作相对于对象。如果路径对中的一条路径强制执行安全操作，而另一条路径没有，IPPO会将其报告为潜在的安全错误。IPPO算法利用基于对象的路径相似性分析，与传统的代码相似性分析方法相比，具有更高的精度。IPPO通过对相似路径对进行差分校验，消除了构造大量相似代码段的要求，解决了传统交叉校验方法的局限性。我们实现了IPPO，并在四个广泛使用的开源程序上对其进行了广泛的评估：Linux内核，OpenSSL库，FreeBSD内核和PHP。IPPO在上述系统中分别发现了154个、5个、1个和1个新的安全漏洞。我们已经为所有这些错误提交了补丁，其中136个已经被相应的维护人员接受。结果证实了IPPO在实践中的有效性和实用性。
Missing a security operation such as a bound check has been a major cause of security-critical bugs. Automatically checking whether the code misses a security operation in large programs is challenging since it has to understand whether the security operation is indeed necessary in the context. Recent methods typically employ cross-checking to identify deviations as security bugs, which collects functionally similar program slices and infers missed security operations through majority-voting. An inherent limitation of such approaches is that they heavily rely on a substantial number of similar code pieces to enable cross-checking. In practice, many code pieces are unique, and thus we may be unable to find adequate similar code snippets to utilize cross-checking. In this paper, we present IPPO (Inconsistent Path Pairs as a bug Oracle), a static analysis framework for detecting security bugs based on differential checking. IPPO defines several novel rules to identify code paths that share similar semantics with respect to an object, and collects them as similar-path pairs. It then investigates the path pairs for identifying inconsistent security operations with respect to the object. If one path in a path pair enforces a security operation while the other does not, IPPO reports it as a potential security bug. By utilizing on object-based path-similarity analysis, IPPO achieves a higher precision, compared to conventional code-similarity analysis methods. Through differential checking of a similar-path pair, IPPO eliminates the requirement of constructing a large number of similar code pieces, addressing the limitation of traditional cross-checking approaches. We implemented IPPO and extensively evaluated it on four widely used open-source programs: Linux kernel, OpenSSL library, FreeBSD kernel, and PHP. IPPO found 154, 5, 1, and 1 new security bugs in the above systems, respectively. We have submitted patches for all these bugs, and 136 of them have been accepted by corresponding maintainers. The results confirm the effectiveness and usefulness of IPPO in practice.