Accurate Instruction-Level Alias Analysis for ARM Executable Code

Chong, Tat-Wai; Chen, Peng‐Sheng

doi:10.1007/978-3-642-35473-1_65

Cited by 1 publication

(1 citation statement)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Reps et al [37] utilized value-set analysis (VSA) to identify pointer alias through tracking memory accesses in x86 executables. Chong et al [15] presented a flow-sensitive algorithm for instruction-level alias analysis on ARM executables, which is context-insensitive. We proposed a new alias analysis technique based on structured symbolic expressions (SSE).…”

Section: Related Workmentioning

confidence: 99%

Finding Taint-Style Vulnerabilities in Linux-based Embedded Firmware with SSE-based Alias Analysis

Cheng,

Liu,

Guan

et al. 2021

Preprint

View full text Add to dashboard Cite

Although the importance of using static analysis to detect taint-style vulnerabilities in Linux-based embedded firmware is widely recognized, existing approaches are plagued by three major limitations. (a) Approaches based on symbolic execution may miss alias information and therefore suffer from a high false-negative rate. (b) Approaches based on VSA (value set analysis) often provide an over-approximate pointer range. As a result, many false positives could be produced. (c) Existing work for detecting taint-style vulnerability does not consider indirect call resolution, whereas indirect calls are frequently used in Internet-facing embedded devices. As a result, many false negatives could be produced.In this work, we propose a precise demand-driven flow-, context-and field-sensitive alias analysis approach. Based on this new approach, we also design a novel indirect call resolution scheme. Combined with sanitization rule checking, our solution discovers taint-style vulnerabilities by static taint analysis. We implemented our idea with a prototype called EmTaint and evaluated it against 35 real-world embedded firmware samples from six popular vendors. EmTaint discovered at least 192 bugs, including 41 n-day bugs and 151 0-day bugs. At least 115 CVE/PSV numbers have been allocated from a subset of the reported vulnerabilities at the time of writing. Compared to state-of-the-art tools such as KARONTE and SaTC, EmTaint found significantly more bugs on the same dataset in less time.

show abstract

Section: Related Workmentioning

confidence: 99%