Abstract
We present a tool for detecting a new type of bad smell in software code and describe how it was used to find critical security bugs, some of which exist in Linux code for many years and are still present in current distributions. Our tool applies state-of-the-art formal methods and static analysis techniques to scan the execution paths of programs. In this scan, the tool detects conditions that may lead to calling certain functions with strange combinations of arguments, called Abnormal Argument Case (AAC) in this paper. These conditions are presented to the developers as they often point at potential bugs and security vulnerabilities. The paper explains how the tool works and describes an empirical evaluation of its performance.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
To make it harder to find the program.
References
Abadi, A., Ettinger, R., Feldman, Y.A., Shomrat, M.: Automatically fixing security vulnerabilities in java code. In: Proceedings of the ACM International Conference Companion on Object Oriented Programming Systems Languages and Applications Companion, pp. 3–4 (2011)
Beck, K.: Code smell (1999). https://wiki.c2.com/?CodeSmell. Accessed 20 Feb 2021
Boudjema, E.H., Verlan, S., Mokdad, L., Faure, C.: VYPER: vulnerability detection in binary code. Secur. Priv. 3(2), e100 (2020)
Cadar, C., Dunbar, D., Engler, D.R., et al.: Klee: unassisted and automatic generation of high-coverage tests for complex systems programs. In: OSDI, vol. 8, pp. 209–224 (2008)
Chen, B., Yang, Z., Lei, L., Cong, K., Xie, F.: Automated bug detection and replay for cots Linux kernel modules with concolic execution. In: 2020 IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER), pp. 172–183 (2020). https://doi.org/10.1109/SANER48275.2020.9054797
Chipounov, V., Kuznetsov, V., Candea, G.: S2E: a platform for in-vivo multi-path analysis of software systems. ACM SIGPLAN Not. 46(3), 265–278 (2011)
Cure53: double-free in curl\(\_\)maprintf (2016). https://curl.se/docs/CVE-2016-8618.html. Accessed 19 Feb 2021
Li, H., Kim, T., Bat-Erdene, M., Lee, H.: Software vulnerability detection using backward trace analysis and symbolic execution. In: 2013 International Conference on Availability, Reliability and Security, pp. 446–454. IEEE (2013). https://doi.org/10.1109/ARES.2013.59
Lu, K., Walter, M.T., Pfaff, D., Nümberger, S., Lee, W., Backes, M.: Unleashing use-before-initialization vulnerabilities in the Linux kernel using targeted stack spraying. In: NDSS (2017)
de Moura, L., Bjørner, N.: Z3: an efficient SMT solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-78800-3_24
Novet, J.: Solar winds hack has shaved 23 percent from software company’s stock this week (2020). https://www.cnbc.com/2020/12/16/solarwinds-hack-triggers-23percent-stock-haircut-this-week-so-far.html
Penrose, R.: Chess problem computers can’t solve? (2017). https://www.consciousentities.com/2017/03/chess-problem-computers-cant-solve/
Shoshitaishvili, Y., et al.: Sok:(state of) the art of war: Offensive techniques in binary analysis. In: 2016 IEEE Symposium on Security and Privacy (SP), pp. 138–157. IEEE (2016)
taviso@google.com: gpg: heap buffer overflow in libgcrypt (2021). https://bugs.chromium.org/p/project-zero/issues/detail?id=2145. Accessed 19 Feb 2021
Acknowledgement
We wish to thank the anonymous reviewers for their valuable comments and suggestions. Specifically, we wish to thank the reviewer that pointed us to the acute need to avoid false positive alarms when a human is involved in the loop.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2021 Springer Nature Switzerland AG
About this paper
Cite this paper
Berlin, M., Margalit, O., Weiss, G. (2021). DepthStAr: Deep Strange Arguments Detection. In: Dolev, S., Margalit, O., Pinkas, B., Schwarzmann, A. (eds) Cyber Security Cryptography and Machine Learning. CSCML 2021. Lecture Notes in Computer Science(), vol 12716. Springer, Cham. https://doi.org/10.1007/978-3-030-78086-9_5
Download citation
DOI: https://doi.org/10.1007/978-3-030-78086-9_5
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-78085-2
Online ISBN: 978-3-030-78086-9
eBook Packages: Computer ScienceComputer Science (R0)