Inferring Patterns for Taint-Style Vulnerabilities With Security Patches

Abstract

Taint-style vulnerabilities can damage the service provided by mobile seriously. The patternbased method is a practical way to detect taint-style vulnerabilities. Most of the methods extract the vulnerability patterns from the code base, however, sometimes missing the vulnerability patterns and resulting in some vulnerabilities undiscovered. The security patches contain valuable information about the vulnerabilities. To compensate for the inherent incompleteness of pattern matching, in this paper, we propose an approach to infer patterns with the security information carried on the security patches. The taint-style vulnerability is described as a 3-tuples (S src , S san , S sink ) here, which consist of sources(S src ), sanitization (S san ), and sinks(S sink ). For each pair of vulnerable and patched programs, we extract the sanitizations from the changes between the vulnerable code and corresponding patches, infer the sinks with the impact analysis, and determine the sources through the backward traversal on the control flow graph. Finally, the completelinkage clustering method is applied to the extracted triples to summary the patterns. We evaluate our method with open source projects. The results show our method is effective: 1) our method infers vulnerability patterns for taint-style vulnerabilities; 2) compared with the method inferring patterns from the code base, new patterns are discovered; and 3) the inferred patterns are applied to search the similar vulnerabilities successfully.INDEX TERMS Code change, static analysis, vulnerability detection.

Fluently specifying taint-flow queries with fluentTQL

“…While much effort has been spent on automatically proposing relevant sources, sanitizers, and sinks (Piskachev et al, 2019;Arzt et al, 2013;Sas et al, 2018) or inference of taint-flows (source-sanitizer-sink paths) (Livshits et al, 2009;Chibotaru et al, 2019;Song et al, 2019), in practice taint analyses still require substantial manual specification effort.…”