Statically Discovering High-Order Taint Style Vulnerabilities in OS Kernels

Zhang, Hang; Chen, Weiteng; Yu, Hao; Li, Guoren; Zhai, Yizhuo; Zou, Xiaochen; Qian, Zhiyun

doi:10.1145/3460120.3484798

Cited by 12 publications

(8 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For this reason, we need the ability to track data flow across syscalls. SUTURE [51] is a static analysis framework for pointsto analysis and data-flow analysis for the Linux kernel. It solves the multi-interaction problem using a summary-based approach.…”

Section: B Cross-syscall Points-to Analysis and Data-flow Analysismentioning

confidence: 99%

“…Intended cross-syscall data-flows result from the multiinteraction characteristic of the kernel, as has been described in §II-B. Without the ability to model them, some memory errors may not be exploitable [51]. We address this challenge by leveraging the cross-syscall point-to analysis from [51], as well as our DFG-based cross-syscall data-flow analysis.…”

Section: Overviewmentioning

confidence: 99%

“…Without the ability to model them, some memory errors may not be exploitable [51]. We address this challenge by leveraging the cross-syscall point-to analysis from [51], as well as our DFG-based cross-syscall data-flow analysis. Unintended cross-syscall data-flows occur when a syscall unintendedly writes to or reads from memory that is used by other syscalls through memory errors.…”

Section: Overviewmentioning

confidence: 99%

“…As shown in Figure 1, M-DFG is constructed based on two inputs: (1) the Linux kernel in LLVM's partial static single assignment (SSA) form, and (2) the point-to information generated by a flow-, context-, and field-sensitive inter-procedural static analysis [51]. We consider most LLVM instructions when constructing M-DFG, including:…”

Section: A Pre-analysismentioning

confidence: 99%

“…We connect the M-DFG of each syscall using cross-syscall RAW edges. Using the cross-syscall points-to information generated by SUTURE [51], we look at all pairs of syscall entries and try to apply RAW rule to connect the store node of one syscall entry to the load node of another.…”

Section: M-dfg Buildermentioning

confidence: 99%

See 4 more Smart Citations

K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel

Liang,

Zou,

Song

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

The severity of information leak (infoleak for short) in OS kernels cannot be underestimated, and various exploitation techniques have been proposed to achieve infoleak in OS kernels. Among them, memory-error-based infoleak is powerful and widely used in real-world exploits. However, existing approaches to finding memory-error-based infoleak lack the systematic reasoning about its search space, and do not fully explore the search space. Consequently, they fail to exploit a large number of memory errors in the kernel. According to a theoretical modeling of memory errors, the actual search space of such approach is huge, as multiple steps could be involved in the exploitation process, and virtually any memory error can be exploited to achieve infoleak. To bridge the gap between the theory and reality, we propose a framework K-LEAK to facilitate generating memory-error-based infoleak exploits in the Linux kernel. K-LEAK considers infoleak exploit generation as a data-flow search problem. By modeling unintended data flows introduced by memory errors, and how existing memory errors can create new memory errors, K-LEAK can systematically search for infoleak data-flow paths in a multistep manner. We implement a prototype of K-LEAK and evaluate it with memory errors from syzbot and CVEs. The evaluation results demonstrate the effectiveness of K-LEAK in generating diverse infoleak exploits using various multi-step strategies.

show abstract

Section: B Cross-syscall Points-to Analysis and Data-flow Analysismentioning

confidence: 99%

Section: Overviewmentioning

confidence: 99%