Saluki: Finding Taint-style Vulnerabilities with Static Property Checking

Abstract

We present Saluki, a new tool for checking taintstyle (data dependence) security properties in binary code. Saluki provides a domain specific language for expressing taint-based policies. Saluki can find vulnerabilities in real programs for a number of CWE types, including those for command injection, weak PRNG seeds, and missing sanitization checks such as SQL escape routines or checks on buffer lengths. Saluki includes two new ideas in binary program analysis. First, Saluki uses µflux, a new static analysis technique for path-sensitive, contextsensitive recovery of data dependence facts in binaries. Second, Saluki introduces a sound logic system for reasoning over data dependence facts. We develop a domain-specific language on top of our logic system to express security properties as formal specifications. Saluki includes a decidable solver procedure to prove (based on the underlying logic) whether a set of data dependence facts satisfy a security property. Our evaluation shows that Saluki is capable of finding vulnerabilities in COTS x86, x86-64, and ARM software, including 0-days

NPDHunter: Efficient Null Pointer Dereference Vulnerability Detection in Binary

“…As mentioned in [11], the main limitation of an emulatorbased approach is that it is difficult to emulate all values in real-word binaries for the kernel and library files. There are no initialization inputs for the kernel and library function analysis; therefore, the emulator usually generates a random input for emulation.…”

“…To the best of our knowledge, cwe_checker [8] and baptoolkit [9] are the state-of-the-art binary vulnerability detection tools. Similarly, Dtaint [10] (only supports ARM32 architecture) and Saluki [11] proposed a generic approach for taint-style vulnerability detection. Unfortunately, both Dtaint [10] and Saluki [10] are not specific to NPD detection and cannot be used to detect an NPD vulnerability directly.…”

“…In contrast, benefited by the microexecution [12]-based analysis engine, Saluki [11] and bap-toolkit [9] not only can emulate the runtime behavior to obtain a concrete value of a register or memory space, but can also cover multiple execution paths depending on the CFG. However, the emulator-style approach also has limitations for unknown values (parameter, global variable) and unknown functions, such as the library function, which the emulator cannot emulate.…”

Inferring Patterns for Taint-Style Vulnerabilities With Security Patches

“…In contrast, other researchers study the security of source code, and many static [6], [8], [10], [11] and dynamic [9] techniques have been proposed to detect vulnerabilities automatically. Gotovchits et al [6] detect the vulnerability in binary-level. They develop a domain-specific language to express security properties and first use µflux technique to generate data dependence facts.…”

“…Researchers have proposed a variety of static(e.g., [6], [8], [10], [11]), and dynamic [9] techniques to detect taint-style vulnerabilities. For example, Gotovchits et al [6] apply the novel technique named µflux to check the taint-style security properties in binary code, and finds 0-day vulnerabilities in COTS x86, x86-64, and ARM software. More recently, pattern-based methods ( [2], [3], [7]) have been provided to…”