基于跨版本测试的编译器引入型漏洞检测方法
Cross-Version Detection for Compiler-Introduced Vulnerabilites
-
摘要: 编译器可能在编译过程中引入安全漏洞.这种编译器引入型漏洞比较隐蔽,会影响绝大多数重要的软件如操作系统内核,数据库,浏览器,有严重的安全风险.如今各类软件包括编译器都在快速地迭代更新,这意味着随时可能有新的漏洞被编译器引入重要的软件二进制代码.实证调研表明,这类漏洞往往在软件中存在较长时间才能被修复.因此,及时地检测到编译器新引入的漏洞对保障软件安全十分重要.学术界已经有不少检测编译器引入的安全漏洞的研究工作.但是现有的检测方法往往只能针对特定的已知的漏洞类型,并且难以高效地应对编译器和待测源程序的高频次更新.因此,我们提出了一种新的基于通用安全代码建模和差分测试的检测技术,可以高效地检测待测程序在版本(编译器或源代码)更新前后,被编译器引入的安全漏洞.该方法基于错误处理函数来定位安全代码,并通过不同版本中安全代码被去除的差异来确定编译器引入的安全问题.基于Linux内核的评估实验表明,我们的方法具有较低的漏报率和满足实际可用性的误报率,可以高效检测到二进制代码版本更新时被编译器新引入的安全漏洞.Abstract: Compilers can introduce security vulnerabilities during the compilation process. These compiler-introduced vulnerabilities are often subtle and can impact critical software such as operating system kernels, databases, and browsers, posing significant security risks. Nowadays, various software, including compilers, are rapidly iterated and updated, which means that new vulnerabilities can be introduced into important software binary code by compilers at any time. Our research indicates that such vulnerabilities often persist in software for a considerable period before being addressed. Therefore, timely detection of newly introduced compiler vulnerabilities is crucial for ensuring software security. There has been extensive research on detecting security vulnerabilities introduced by compilers. However, existing detection methods often focus on specific known vulnerability types and struggle to efficiently handle the frequent updates of compilers and the programs being tested. Consequently, we propose a novel detection technique based on general security code modeling and differential testing, which can efficiently identify security vulnerabilities introduced by compilers in the target program before and after version updates (either in the compiler or source code). This method identifies security code through error handling functions and determines compiler-introduced vulnerabilities by examining the differences in the removal of security checks across different versions. Evaluation experiments conducted on the Linux kernel demonstrate that our approach achieves a low false negative rate, maintains a practical false positive rate, and efficiently detects security vulnerabilities newly introduced by compilers during the compilation process of binary code updates.
下载: