Hardening attack surfaces with formally proven binary format parsers

An analysis of how many undiscovered vulnerabilities remain in information systems

“…There is some work in verification of the properties of protocols, such as TLS. Microsoft has successfully deployed formal parser verification in network stack handling for the Windows Virtual Switch [48], for example, which eliminates many classes of implementation vulnerabilities in that component. This does not comment on whether TCP as specified has flaws or ambiguities.…”

FastVer2: A Provably Correct Monitor for Concurrent, Key-Value Stores

“…So we need to make sure to read each input byte at most once. While EverParse allows generating input data validators formally guaranteed against double fetches [24], these validators do not cover the subset of EverParse that we are using for our log types. So, we need to allocate a temporary buffer and copy the contents of the input buffer there, and let the verifier operate from there.…”