Progressive Scrutiny: Incremental Detection of UBI bugs in the Linux Kernel

Zhai, Yizhuo; Yu, Han‐Qing; Zhang, Zheng; Chen, Weiteng; Li, Guoren; Qian, Zhiyun; Song, Chengyu; Sridharan, Manu; Krishnamurthy, Srikanth V.; Jaeger, Trent; Yu, Paul K. L.

doi:10.14722/ndss.2022.24380

Cited by 6 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Given the time-intensive and complex nature of the cases, manual analysis usually focuses on a sample of cases. When the total number of cases is substantial, state-of-the-art practices [4,12,15,30,43,48,49,55] typically sample and manually analyze 40-400 cases. According to the previous study [7], such sampling ratios would result in a margin of error between ±5% to ±15%.…”

Section: A Experiments Setting and Data Setsmentioning

confidence: 99%

“…Indirect-call analysis is critical for these tools, but false positives can impede bug detection. For example, as the claims from INCRELUX [55] and DiffCVSS [49], using traditional techniques, such as type analysis, to identify indirect calls will introduce high false positives into their results and sometimes even make the tool unusable. Our study found that imprecise indirect call analysis is a major contributor to the results of Crix, accounting for 59% of the total warnings.…”

Section: A Leveraging Abstract Similarity For Enhanced Bug Detectionmentioning

confidence: 99%

“…For example, the Linux kernel 5.7 and Android kernel 5.10 have more than 55K and 62K indirect call sites. Accurately identifying these indirect calls is critical for building precise call graphs and control flow graphs, which are the basis of modern program analysis and security analysis, including bug detection [55], program debloating [1,39], directed fuzzing [5,35], vulnerability assessment [49], model checking [3], and many others [13,37,38,47].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

GNNIC: Finding Long-Lost Sibling Functions with Abstract Similarity

Wu,

Gu,

Jamjoom

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Generating accurate call graphs for large programs, particularly at the operating system (OS) level, poses a well-known challenge. This difficulty stems from the widespread use of indirect calls within large programs, wherein the computation of call targets is deferred until runtime to achieve program polymorphism. Consequently, compilers are unable to statically determine indirect call edges. Recent advancements have attempted to use type analysis to globally match indirect call targets in programs. However, these approaches still suffer from low precision when handling large target programs or generic types. This paper presents GNNIC, a Graph Neural Network (GNN) based Indirect Call analyzer. GNNIC employs a technique called abstract-similarity search to accurately identify indirect call targets in large programs. The approach is based on the observation that although indirect call targets exhibit intricate polymorphic behaviors, they share common abstract characteristics, such as function descriptions, data types, and invoked function calls. We consolidate such information into a representative abstraction graph (RAG) and employ GNNs to learn function embeddings. Abstract-similarity search relies on at least one anchor target to bootstrap. Therefore, we also propose a new program analysis technique to locally identify valid targets of each indirect call. Starting from anchor targets, GNNIC can expand the search scope to find more targets of indirect calls in the whole program. The implementation of GNNIC utilizes LLVM and GNN, and we evaluated it on multiple OS kernels. The results demonstrate that GNNIC outperforms state-of-the-art type-based techniques by reducing 86% to 93% of false target functions. Moreover, the abstract similarity and precise call graphs generated by GNNIC can enhance security applications by discovering new bugs, alleviating path-explosion issues, and improving the efficiency of static program analysis. The combination of static analysis and GNNIC resulted in finding 97 new bugs in Linux and FreeBSD kernels.

show abstract