ELAID: detecting integer-Overflow-to-Buffer-Overflow vulnerabilities by light-weight and accurate static analysis

Lili Xu,Mingjie Xu,Feng Li,Wei Huo

doi:10.1186/s42400-020-00058-2

Abstract

The Integer-Overflow-to-Buffer-Overflow (IO2BO) vulnerability has been widely exploited by attackers to cause severe damages to computer systems. Automatically identifying this kind of vulnerability is critical for software security. Despite many works have been done to mitigate integer overflow, existing tools either report large number of false positives or introduce unacceptable time consumption. To address this problem, in this article we present a static analysis framework. It first constructs an inter-procedural call graph and utilizes taint analysis to accurately identify potential IO2BO vulnerabilities. Then it uses a light-weight method to further filter out false positives. Specifically, it generates constraints representing the conditions under which a potential IO2BO vulnerability can be triggered, and feeds the constraints to SMT solver to decide their satisfiability. We have implemented a prototype system ELAID based on LLVM, and evaluated it on 228 programs of the NIST’s SAMATE Juliet test suite and 14 known IO2BO vulnerabilities in real world. The experiment results show that our system can effectively and efficiently detect all known IO2BO vulnerabilities.

Highlights

Integer overflow is one of the most common types of software vulnerabilities
If the malformed value generated by integer overflow (IO for short) is used for determining how much memory to allocate, it will cause a buffer overflow (BO for short), which is known as the Integer Overflow to Buffer Overflow vulnerability (CWE-680: IO2BO Vulnerabilities 2020)
If any operand of an arithmetic operation is tainted and the result is used in a memory allocation function, we identify it as a potential IO2BO vulnerability

Summary

Introduction

Integer overflow is one of the most common types of software vulnerabilities. According to the Common Vulnerability and Exploit (CVE) (Common Vulnerabilities and Exposures (CVE) 2020), integer overflow has become the second most critical type of coding errors, second only to buffer overflows (Christey and Martin 2007). According to (Zhang et al 2010), it is difficult to distinguish integer overflow vulnerabilities from benign overflows, but in the. IO2BO is being widely exploited by attackers to cause severe damages to computer systems, such as (Chen et al 2005; Sotirov 2007; Vreugdenhil 2020). As IO2BO vulnerabilities have become a dominant kind of integer overflow vulnerabilities in practice, a variety of solutions have been proposed for IO2BO detection. (Zhang et al 2010; Dietz et al 2012; Wang et al 2010; Chen et al The solutions can be categorized into approaches based on static analysis (e.g. Wang et al (2012, 2009) and those depended on dynamic testing

Methods

Results

Conclusion