|
Home
|
|
|
|
|
ESEC/FSE'20 (The ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering)
|
|
|
Y. Zhai, Y. Hao, H. Zhang, D. Wang, C. Song, Z. Qian, M. Lesani, S. Krishnamurthy, P. Yu. |
|
|
|
|
|
Use-before-Initialization
(UBI) bugs in the Linux kernel have serious security impacts, such as
information leakage and privilege escalation. Developers are adopting
forced initialization to cope with UBI bugs, but this approach can
still lead to undefined behaviors (e.g., NULL pointer dereference). As
it is hard to infer correct initialization values, we believe that the
best way to mitigate UBI bugs is detection and manual patching. Precise
detection of UBI bugs requires path-sensitive analysis. The detector
needs to track an associated variable’s initialization status along all
the possible program execution paths to its uses. However, such
exhaustive analysis prevents the detection from scaling to the whole
Linux kernel. This paper presents UbiTect, a UBI bug finding tool which
combines flow-sensitive type qualifier analysis and symbolic execution
to perform precise and scalable UBI bug detection. The scalable
qualifier analysis guides symbolic execution to analyze variables that
are likely to cause UBI bugs. UbiTect also does not require manual
effort for annotations and hence, it can be directly applied to the
kernel without any source code or intermediate representation (IR)
change. On the Linux kernel version 4.14, UbiTect reported 190 bugs,
among which 78 bugs were deemed by us as true positives and 52 were
confirmed by Linux maintainers.
|
|
|
Paper
Appendix
|
|
|
|