Not All Bugs Are Created Equal, But Robust Reachability Can Tell the Difference

Abstract

This paper introduces a new property called robust reachability which refines the standard notion of reachability in order to take replicability into account. A bug is robustly reachable if a controlled input can make it so the bug is reached whatever the value of uncontrolled input. Robust reachability is better suited than standard reachability in many realistic situations related to security (e.g., criticality assessment or bug prioritization) or software engineering (e.g., replicable test suites and flakiness). We propose a formal treatment of the concept, and we revisit existing symbolic bug finding methods through this new lens. Remarkably, robust reachability allows differentiating bounded model checking from symbolic execution while they have the same deductive power in the standard case. Finally, we propose the first symbolic verifier dedicated to robust reachability: we use it for criticality assessment of 4 existing vulnerabilities, and compare it with standard symbolic execution.

At the Bottom of Binary Analysis: Instructions

“…Finally, the last but not the least of the tools under our scope is binsec. In [2], Girol, Farinier and Bardin consider another application of symbolic computations: bug tracking.…”

Automatic Detection of Vulnerable Variables for CTL Properties of Programs

“…The program property of robust reachability [8,9] refines the standard notion of reachability of a bug given a partition of the program variables in a controlled and an uncontrolled set: a bug is robustly reachable if it is reachable whatever the values of the uncontrolled variables. FuncTion -V can analyze robust reachability properties expressible as a CTL formula of the form AFϕ.…”

“…Violations of program properties pose significant risks, particularly when they can be triggered by attackers [8,14]. This paper presents our tool FuncTion -V for the automatic identification of the minimal set(s) of program variables that are vulnerable to be controlled by an attacker to potentially violate a (desirable) program property, or, equivalently, the minimal variable set(s) the values of which must be controlled to ensure an (undesirable) program property.…”

“…Let us consider the undesirable robust reachability [8,9] of the error location in Figure 1. Here, to make sure that the error location is reached, an attacker can either (A) control the value of x ensuring that x > 0 (error reachable independently of the values of y and z), or (B) control the value of y and z ensuring that y ≤ z (error reachable independently of the value of x).…”

“…Besides robust reachability [8,9,18,19], FuncTion -V more generally supports program properties expressed in Computation Tree Logic (CTL) [2] (e.g., termination [16], recurrence properties [18,19], etc.). To improve the precision of our approach, we have equipped Func-Tion -V with a conflict-driven abstraction refinement-style analysis [7].…”