UBITect: a precise and scalable method to detect use-before-initialization bugs in Linux kernel
UBITect: a precise and scalable method to detect use-before-initialization bugs in Linux kernel
复制标题
DOI：
10.1145/3368089.3409686
复制
发表时间：
2020-11
期刊：
影响因子：
--
通讯作者：
Yizhuo Zhai;Yu Hao;Hang Zhang;Daimeng Wang;Chengyu Song;Zhiyun Qian;M. Lesani;S. Krishnamurthy;Paul L. Yu
中科院分区：
文献类型：
--
作者：
Yizhuo Zhai;Yu Hao;Hang Zhang;Daimeng Wang;Chengyu Song;Zhiyun Qian;M. Lesani;S. Krishnamurthy;Paul L. Yu
Linux内核中的使用前启动（UBI）错误具有严重的安全性影响，例如信息泄漏和特权升级，开发人员正在采用强制初始化来应对UBI错误，但是这种方法仍然会导致不确定的行为（例如NULL，NULL，NULL，指针取消），因为很难推断出初始化值，我们认为减轻UBI错误的最佳方法是检测和手动修补UBI的错误需要对路径敏感的分析。 ，一种UBI错误查找工具，结合了流动类型的预选程序分析和符号执行，以执行精确和可扩展的UBI错误检测。可伸缩的预选程序指导符号执行以分析可能导致UBI错误的变量，也不需要手动努力进行注释，因此可以直接应用于内核而没有任何源代码或中间表示（IR）。在Linux内核版本4.14上，Ubitect报告了190个错误，其中有78个错误被我们视为真正的阳性和52个错误由Linux维护者。
Use-before-Initialization (UBI) bugs in the Linux kernel have serious security impacts, such as information leakage and privilege escalation. Developers are adopting forced initialization to cope with UBI bugs, but this approach can still lead to undefined behaviors (e.g., NULL pointer dereference). As it is hard to infer correct initialization values, we believe that the best way to mitigate UBI bugs is detection and manual patching. Precise detection of UBI bugs requires path-sensitive analysis. The detector needs to track an associated variable’s initialization status along all the possible program execution paths to its uses. However, such exhaustive analysis prevents the detection from scaling to the whole Linux kernel. This paper presents UBITect, a UBI bug finding tool which combines flow-sensitive type qualifier analysis and symbolic execution to perform precise and scalable UBI bug detection. The scalable qualifier analysis guides symbolic execution to analyze variables that are likely to cause UBI bugs. UBITect also does not require manual effort for annotations and hence, it can be directly applied to the kernel without any source code or intermediate representation (IR) change. On the Linux kernel version 4.14, UBITect reported 190 bugs, among which 78 bugs were deemed by us as true positives and 52 were confirmed by Linux maintainers.