OS-Aware Vulnerability Prioritization via Differential Severity Analysis
OS-Aware Vulnerability Prioritization via Differential Severity Analysis
复制标题
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Qiushi Wu;Yue Xiao;Xiaojing Liao;Kangjie Lu
中科院分区：
文献类型：
--
作者：
Qiushi Wu;Yue Xiao;Xiaojing Liao;Kangjie Lu
Linux内核正在快速发展和广泛定制。这导致了成千上万的版本和衍生物。不幸的是，Linux内核非常脆弱。每年都有数以千计的bug被报告，其中数百个是与安全相关的bug。由于资源有限，内核维护人员必须优先修补更严重的漏洞。在实践中，通用漏洞评分系统（CVSS）[1]已成为表征漏洞严重性的标准。然而，当CVSS遇到Linux时，存在一个基本问题-它以“一个为所有”的方式使用。Linux漏洞的严重性仅针对主流Linux进行评估，所有受影响的版本和衍生版本将简单地荣誉并重用CVSS分数。这种不加区分的CVSS使用导致低估或高估严重性，这进一步导致延迟和忽略修补或浪费宝贵资源。在本文中，我们提出了OS感知的漏洞优先级（即D IFF CVSS），它采用不同的严重性分析的漏洞。具体而言，给定严重性评估的漏洞，以及Linux的主流版本和目标版本，D IFF CVSS采用基于静态程序分析和自然语言处理的多种新技术来区分漏洞在目标版本中表现出更高或更低的严重性。这种方法的一个独特优势是它将具有挑战性和费力的CVSS计算转换为可自动化的差分分析。实现了DIFF CVSS，并将其应用于主流Linux和下游Android系统。评估和用户研究结果表明，D IFF CVSS能够精确地执行差异严重性分析，并提供了一个精确和有效的方法来识别漏洞，值得严重性重新评估。
The Linux kernel is quickly evolving and extensively customized. This results in thousands of versions and derivatives. Unfortunately, the Linux kernel is quite vulnerable. Each year, thousands of bugs are reported, and hundreds of them are security-related bugs. Given the limited resources, the kernel maintainers have to prioritize patching the more severe vulnerabilities. In practice, Common Vulnerability Scoring System (CVSS) [1] has become the standard for characterizing vulnerability severity. However, a fundamental problem exists when CVSS meets Linux—it is used in a “one for all” manner. The severity of a Linux vulnerability is assessed for only the mainstream Linux, and all affected versions and derivatives will simply honor and reuse the CVSS score. Such an undistinguished CVSS usage results in underestimation or overestimation of severity, which further results in delayed and ignored patching or wastes of the precious resources. In this paper, we propose OS-aware vulnerability prioritization (namely D IFF CVSS), which employs differential severity analysis for vulnerabilities. Specifically, given a severity-assessed vulnerability, as well as the mainstream version and a target version of Linux, D IFF CVSS employs multiple new techniques based on static program analysis and natural language processing to differentially identify whether the vulnerability manifests a higher or lower severity in the target version. A unique strength of this approach is that it transforms the challenging and laborious CVSS calculation into automatable differential analysis. We implement D IFF CVSS and apply it to the mainstream Linux and downstream Android systems. The evaluation and user-study results show that D IFF CVSS is able to precisely perform the differential severity analysis, and offers a precise and effective way to identify vulnerabilities that deserve a severity reevaluation.