Automatically Identifying Security Checks for Detecting Kernel Semantic Bugs
Automatically Identifying Security Checks for Detecting Kernel Semantic Bugs
复制标题
DOI：
10.1007/978-3-030-29962-0_1
复制
发表时间：
2019-09
期刊：
影响因子：
--
通讯作者：
Kangjie Lu;Aditya Pakki;Qiushi Wu
中科院分区：
文献类型：
--
作者：
Kangjie Lu;Aditya Pakki;Qiushi Wu
操作系统内核强制执行大量安全检查来验证系统状态。我们观察到，安全检查实际上在推断操作系统内核中的关键语义方面提供了非常丰富的信息。具体来说，安全检查可以揭示(1)某个操作或变量是否至关重要但可能是错误的，(2)可能发生哪些特定的错误，以及(3)应该对变量或函数的使用实施哪些约束。这些信息对于检测内核语义错误特别有价值，因为检测通常需要理解关键语义。然而，由于缺乏明确的标准，而且安全检查的多样性，确定安全检查是具有挑战性的。在本文中，我们首先系统地研究了安全检查，并提出了一种大多数自动化的方法来识别操作系统内核中的安全检查。基于已识别的安全检查提供的信息，我们随后开发了多个分析器，用于检测操作系统内核中三种常见但关键的语义错误，包括空指针解引用、缺失错误处理和双重获取。我们在LLVM通过时实现了识别和分析器，并使用Linux内核和FreeBSD内核对它们进行了评估。评估结果表明，我们的安全检查识别具有很低的假阴性和假阳性率。我们还在两个内核中发现了164个新的语义错误，其中88个已经通过我们的补丁修复了。评估结果证实了我们的系统可以准确地识别安全检查，这有助于有效地识别复杂操作系统内核中的许多关键语义错误。
OS kernels enforce a large number of security checks to validate system states. We observe that security checks are in fact very informative in inferring critical semantics in OS kernels. Specifically, security checks can reveal (1) whether an operation or a variable is critical but can be erroneous, (2) what particular errors may occur, and (3) constraints that should be enforced for the uses of a variable or a function. Such information is particularly valuable for detecting kernel semantic bugs because the detection typically requires understanding critical semantics. However, identifying security checks is challenging due to not only the lack of clear criteria but also the diversity of security checks.In this paper, we first systematically study security checks and propose a mostly-automated approach to identify security checks in OS kernels. Based on the information offered by the identified security checks, we then develop multiple analyzers that detect three classes of common yet critical semantic bugs in OS kernels, including NULL-pointer dereferencing, missing error handling, and double fetching. We implemented both the identification and the analyzers as LLVM passes and evaluated them using the Linux kernel and the FreeBSD kernel. Evaluation results show that our security-check identification has very low false-negative and false-positive rates. We also have found 164 new semantic bugs in both kernels, 88 of which have been fixed with our patches. The evaluation results confirm that our system can accurately identify security checks, which helps effectively identify numerous critical semantic bugs in complex OS kernels.