NPDHunter: Efficient Null Pointer Dereference Vulnerability Detection in Binary

Abstract

Null pointer dereference (NPD) is a widespread vulnerability that occurs whenever an executing program attempts to dereference a null pointer. NPD vulnerability can be exploited by hackers to maliciously crash a process to cause a denial of service or execute an arbitrary code under specific conditions. This typical taintstyle vulnerability requires an accurate data dependency analysis to trace whether a source is propagated to a sensitive sink without proper sanitization. The primary challenge in data dependency analysis is pointer aliasing, which may significantly affect the vulnerability detection accuracy. Although there have been many studies and open-source tools, they still have limitations when detecting a real-world binary. In this paper, we propose a static binary analysis approach to detect an NPD vulnerability. To improve detection accuracy and practicality, we first identify two challenges that affect the accuracy of binary NPD detection: (i) pointer aliasing, and (ii) untrusted source identification. Then we implement a prototype of the proposed approach, NPDHunter, and evaluate it against 318 test cases provided by Juliet Test Suite v1.3. For the Juliet dataset, NPDHunter is accurate in detecting NPDs and generates 0% false negatives; as compared to bap-toolkit and cwe_checker, which have false-negative rates of 70.89% and 89.81%, respectively. We also evaluate NPDHunter for real-world binaries which recently reported NPD vulnerability. We have analyzed XNU kernel (large-scale), Redis, Bitlbee, libredwg, and libvncserver binaries and NPDHunter can detect all NPD cases, which justifies its usefulness for real-world binaries; compiled for x86_64 architecture.

A Critical Overview of Industrial Internet of Things Security and Privacy Issues Using a Layer-Based Hacking Scenario

“…Furthermore, the attacker exploits the lack of memory protection on the ERP to gain control over the computer's memory, where the ERP is running. This allows the attacker to corrupt the memory and carry out a Null Pointer Dereference attack [142], another form of memory-based attack that can crash the ERP and facilitate a successful DoS attack. The vulnerability exploited here is the lack of memory protection.…”

Research on cloud server double end vulnerability detection based on heuristic genetic algorithm

“…In recent years, Internet security problems have occurred frequently, and various cloud servers have run into crisis, seriously reducing the network credibility. According to the 2014 Internet Security Threat Report, more than 70% of websites nationwide have server vulnerabilities, of which 20% are high-risk vulnerabilities [12][13][14][15]. Although relevant researchers have designed several conventional dual end vulnerability detection methods based on the characteristics of dual end servers, most detection methods need to use the crawler detection algorithm to obtain detection parameters, which is difficult to effectively connect with the form URL.…”