Improving integer security for systems with KINT

Proceedings of the 10th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2012

Volumn , Issue , 2012, Pages 163-177

  Wang, Xi ^a   Chen, Haogang ^a   Jia, Zhihao ^b   Zeldovich, Nickolai ^a   Frans Kaashoek, M ^a  

^a MASSACHUSETTS INSTITUTE OF TECHNOLOGY   (United States)

^b TSINGHUA UNIVERSITY   (China)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER OPERATING SYSTEMS; ERRORS; INTEGER PROGRAMMING; SEMANTICS; SODIUM COMPOUNDS; STATIC ANALYSIS; SYSTEMS ANALYSIS;

BUFFER OVERFLOWS; C PROGRAMS; CONSTRAINT SOLVERS; LINUX KERNEL; SOURCE CODES; SYSTEMS SECURITY; USER ANNOTATIONS; WEB SERVERS;

C (PROGRAMMING LANGUAGE);

EID: 84893504229     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (38)

1. Common vulnerabilities and exposures (CVE). http://cve.mitre.org/.
2. ext4: fixpoint divide exception at ext4_fill_super. Bug 14287, Linux kernel, 2009. https://bugzilla.kernel.org/show_bug.cgi?id=14287.
3. K. Ashcraft and D. Engler. Using programmer-written compiler extensions to catch security holes. In Proceedings of the 23rd IEEE Symposium on Security and Privacy, pages 143-159, Oakland, CA, May 2002.
4. D. Brumley, T. Chiueh, and R. Johnson. RICH: Automatically protecting against integer-based vulnerabilities. In Proceedings of the 14th Annual Network and Distributed System Security Symposium, San Diego, CA, Feb-Mar 2007.
5. R. Brummayer. Efficient SMT Solving for Bit-Vectors and the Extensional Theory of Arrays. PhD thesis, Johannes Kepler University, Linz, Austria, Nov 2009.
6. W. R. Bush, J. D. Pincus, and D. J. Sielaff. A static analyzer for finding dynamic programming errors. Software-Practice and Experience, 30(7):775-802, 2000.
7. C. Cadar, D. Dunbar, and D. Engler. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In Proceedings of the 8th Symposium on Operating Systems Design and Implementation, San Diego, CA, Dec 2008.
8. E. N. Ceesay, J. Zhou, M. Gertz, K. Levitt, and M. Bishop. Using type qualifiers to analyze untrusted integers and detecting security flaws in C programs. In Proceedings of the 3rd GI/IEEE SIG SIDAR Conference on Detection of Intrusions & Malware, and Vulnerability Assessment, pages 1-16, Berlin, Germany, Jul 2006.
9. H. Chen, Y. Mao, X. Wang, D. Zhou, N. Zeldovich, and M. F. Kaashoek. Linux kernel vulnerabilities: State-of-the-art defenses and open problems. In Proceedings of the 2nd Asia-Pacific Workshop on Systems, Shanghai, China, Jul 2011.
10. P. Chen, H. Han, Y. Wang, X. Shen, X. Yin, B. Mao, and L. Xie. IntFinder: Automatically detecting integer bugs in x86 binary program. In Proceedings of the 11th International Conference on Information and Communications Security, pages 336-345, Beijing, China, Dec 2009.
11. R. Chinchani, A. Iyer, B. Jayaraman, and S. Upadhyaya. ARCHERR: Runtime environment driven program safety. In Proceedings of the 9th European Symposium on Research in Computer Security, pages 385-406, Sophia Antipolis, France, Sep 2004.
12. S. Christey and R. A. Martin. Vulnerability Type Distributions in CVE, May 2007. http://cve.mitre.org/docs/vuln-trends/vuln-trends.pdf.
13. D. Crocker. Verifying absence of integer overflow, Jun 2010. http://critical.eschertech.com/2010/06/07/verifying-absence-of-integer-overflow/.
14. R. B. Dannenberg, W. Dormann, D. Keaton, T. Plum, R. C. Seacord, D. Svoboda, A. Volkovitsky, and T. Wilson. As-if infinitely ranged integer model. In Proceedings of the 21st IEEE International Symposium on Software Reliability Engineering, pages 91-100, San Jose, CA, Nov 2010.
15. W. Dietz, P. Li, J. Regehr, and V. Adve. Understanding integer overflow in C/C++. In Proceedings of the 34th International Conference on Software Engineering, Zurich, Switzerland, Jun 2012.
16. D. Evans, J. V. Guttag, J. J. Horning, and Y. M. Tan. LCLint: A tool for using specifications to check code. In Proceedings of the ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 87-96, New Orleans, LA, Dec 1994.
17. J. Gennari, S. Hedrick, F. Long, J. Pincar, and R. C. Seacord. Ranged integers for the C programming language. Technical Note CMU/SEI-2007-TN-027, Carnegie Mellon University, 2007.
18. W. H. Harrison. Compiler analysis of the value ranges for variables. IEEE Transactions on Software Engineering, SE-3(3):243-250, May 1977.
19. O. Horovitz. Big loop integer protection. Phrack, 9(60), 2002.
20. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 1: Basic Architecture. Intel, 2011.
21. ISO/IEC 9899:2011, Programming languages - C. ISO/IEC, 2011.
22. D. LeBlanc. Integer handling with the C++ SafeInt class. http://msdn.microsoft.com/en-us/library/ms972705, 2004.
23. V. B. Livshits and M. S. Lam. Tracking pointers with path and context sensitivity for bug detection in C programs. In Proceedings of the ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 317-326, Helsinki, Finland, Sep 2003.
24. F. Merz, S. Falke, and C. Sinz. LLBMC: Bounded model checking of C and C++ programs using a compiler IR. In Proceedings of the 4th International Conference on Verified Software: Theories, Tools, and Experiments, Philadelphia, PA, Jan 2012.
25. D. Molnar, X. C. Li, and D. A. Wagner. Dynamic test generation to find integer bugs in x86 binary Linux programs. In Proceedings of the 18th USENIX Security Symposium, pages 67-81, Montreal, Canada, Aug 2009.
26. Y. Moy. Automatic Modular Static Safety Checking for C Programs. PhD thesis, Université Paris-Sud, Orsay, France, Jan 2009.
27. Y. Moy, N. Bjørner, and D. Sielaff. Modular bug-finding for integer overflows in the large: Sound, efficient, bit-precise static analysis. Technical Report MSR-TR-2009-57, Microsoft Research, 2009.
28. S. S. Muchnick. Advanced Compiler Design and Implementation. Morgan Kaufmann, 1997.
29. E. Revfy. Inside the size overflow plugin. http://forums.grsecurity.net/viewtopic.php?f=7&t=3043, Aug 2012.
30. D. Sarkar, M. Jagannathan, J. Thiagarajan, and R. Venkatapathy. Flow-insensitive static analysis for detecting integer anomalies in programs. Technical Report MSR-TR-2006-44, Microsoft Research, 2006.
31. C. Schafer. [PATCH v3] perf: prevent overflow in size calculation. https://lkml.org/lkml/2012/7/19/507, Jul 2012.
32. R. C. Seacord. The CERT C Secure Coding Standard. Addison-Wesley Professional, 2008.
33. R. A. van Engelen. Efficient symbolic analysis for optimizing compilers. In Proceedings of the 10th International Conference on Compiler Construction, pages 118-132, Genova, Italy, Apr 2001.
34. T. Wang, T. Wei, Z. Lin, and W. Zou. IntScope: Automatically detecting integer overflow vulnerability in x86 binary using symbolic execution. In Proceedings of the 16th Annual Network and Distributed System Security Symposium, San Diego, CA, Feb 2007.
35. X. Wang, H. Chen, A. Cheung, Z. Jia, N. Zeldovich, and M. F. Kaashoek. Undefined behavior: What happened to my code? In Proceedings of the 3rd ACM SIGOPS Asia-Pacific Workshop on Systems, Seoul, South Korea, Jul 2012.
36. R. Wojtczuk. UQBTng: A tool capable of automatically finding integer overflows in Win32 binaries. In Proceedings of the 22nd Chaos Communication Congress, Berlin, Germany, Dec 2005.
37. Y. Xie and A. Aiken. Scalable error detection using Boolean satisfiability. In Proceedings of the 32nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pages 351-363, Long Beach, CA, Jan 2005.
38. C. Zhang, T. Wang, T. Wei, Y. Chen, and W. Zou. IntPatch: Automatically fix integer-overflow-to-buffer-overflow vulnerability at compile-time. In Proceedings of the 15th European Symposium on Research in Computer Security, pages 71-86, Athens, Greece, Sep 2010.