堆分配大小可控的检测与分析

发布时间：2018-06-08 01:41

本文选题：漏洞分析 + 符号执行　；参考：《清华大学学报(自然科学版)》2015年05期

【摘要】：不当内存操作一直是引发软件漏洞的主要原因之一。堆分配大小可控(CMA)是指当动态内存分配的关键参数可以被外界输入控制时,恶意用户可以通过精心构造输入数据导致非预期的内存分配。该文讨论了CMA可能引发的相关安全问题和CMA的检测方法。该CMA检测方法主要通过结合静态路径分析和路径导向符号执行技术的优势,系统地检测目标代码中的CMA问题。在经典的符号执行引擎KLEE的基础上,实现了CMA检测原型系统SCAD;通过对Linux系统常用的工具程序Coreutils进行测试,SCAD发现了10个CMA相关的问题,其中3个属于未公开漏洞。实验结果表明:SCAD的导向路径搜索算法与KLEE提供的8个路径搜索算法相比具有明显优势;针对内存分配相关的代码,SCAD的导向符号执行相比传统的符号执行引擎具有更高的代码覆盖率。
[Abstract]:Improper memory operation has been one of the main causes of software vulnerabilities. When the key parameters of dynamic memory allocation can be controlled by external input, malicious users can input data carefully to lead to unexpected memory allocation. In this paper, the related security problems caused by CMA and the detection method of CMA are discussed. The CMA detection method systematically detects the CMA problem in the target code by combining the advantages of static path analysis and path-oriented symbol execution technology. Based on the classical symbol execution engine (KLEE), the prototype system of CMA detection is implemented, and 10 CMA related problems are found by testing the common tool program Coreutils in Linux system, three of which are undisclosed vulnerabilities. The experimental results show that the guided path search algorithm proposed by the President SCAD has obvious advantages over the eight path search algorithms provided by KLEE. Compared with the traditional symbol execution engine, SCAD has higher code coverage than the traditional symbol execution engine.
【作者单位】：清华大学计算机科学与技术系;北方电子设备研究所;解放军电子工程学院网络工程系;
【基金】：国家自然科学基金面上项目(61170050) 核高基重大专项(2012ZX01039-004)
【分类号】：TP311.1;TP333

【参考文献】