AI Chat Paper
Note: Please note that the following content is generated by AMiner AI. SciOpen does not take any responsibility related to this content.
{{lang === 'zh_CN' ? '文章概述' : 'Summary'}}
{{lang === 'en_US' ? '中' : 'Eng'}}
Chat more with AI
Powered by AMiner. Clicking this button will take you away from SciOpen.
Home Journal of Computer Science and Technology Article
Article Link
Cite
EndNote(RIS) BibTeX
Collect
Submit Manuscript
Show Outline
Outline
Show full outline
Hide outline
Outline
Show full outline
Hide outline
Regular Paper

MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels

College of Computer Science and Technology, National University of Defense Technology, Changsha, 410073, China
Show Author Information

Abstract

Allocation, dereferencing, and freeing of memory data in kernels are coherently linked. There widely exist real cases where the correctness of memory is compromised. This incorrectness in kernel memory brings about significant security issues, e.g., information leaking. Though memory allocation, dereferencing, and freeing are closely related, previous work failed to realize they are closely related. In this paper, we study the life-cycle of kernel memory, which consists of allocation, dereferencing, and freeing. Errors in them are called memory life-cycle (MLC) bugs. We propose an in-depth study of MLC bugs and implement a memory life-cycle bug sanitizer (MEBS) for MLC bug detection. Utilizing an inter-procedural global call graph and novel identification approaches, MEBS can reveal memory allocation, dereferencing, and freeing sites in kernels. By constructing a modified define-use chain and examining the errors in the life-cycle, MLC bugs can be identified. Moreover, the experimental results on the latest kernels demonstrate that MEBS can effectively detect MLC bugs, and MEBS can be scaled to different kernels. More than 100 new bugs are exposed in Linux and FreeBSD, and 12 common vulnerabilities and exposures (CVE) are assigned.

Keywords

static analysissoftware securityoperating systemvulnerability detectionmemory life-cycle

Electronic Supplementary Material

Download File(s)
jcst-36-6-1248-Highlights.pdf (151.4 KB)

References

[1]
Akritidis P, Cadar C, Raiciu C, Costa M, Castro M. Preventing memory error exploits with WIT. In Proc. the 2008 IEEE Symposium on Security and Privacy, May 2008, pp.263-277. DOI: 10.1109/SP.2008.30.
Crossref
[2]
Lee B, Song C, Kim T, Lee W. Type casting verification: Stopping an emerging attack vector. In Proc. the 24th USENIX Security Symposium, Aug. 2015, pp.81-96.
[3]
Szekeres L, Payer M, Wei T, Song D. SoK: Eternal war in memory. In Proc. the 2013 IEEE Symposium on Security and Privacy, May 2013, pp.48-62. DOI: 10.1109/SP.2013.13.
Crossref
[4]
Xu J, Mu D, Chen P, Xing X, Wang P, Liu P. CREDAL: Towards locating a memory corruption vulnerability with your core dump. In Proc. the 2016 ACM SIGSAC Conference on Computer and Communications Security, Oct. 2016, pp.529-540. DOI: 10.1145/2976749.2978340.
Crossref
[5]

Zhang G. Detecting memory life-cycle bugs with extended define-use chain analysis. IEEE Access, 2020, 8: 114968-114980. DOI: 10.1109/ACCESS.2020.2999351.
Crossref Google Scholar
[6]
He B, Rastogi V, Cao Y, Chen Y, Venkatakrishnan V N, Yang R, Zhang Z. Vetting SSL usage in applications with SSLINT. In Proc. the 2015 IEEE Symposium on Security and Privacy, May 2015, pp.519-534. DOI: 10.1109/SP.2015.38.
Crossref
[7]
Yamaguchi F, Golde N, Arp D, Rieck K. Modeling and discovering vulnerabilities with code property graphs. In Proc. the 2014 IEEE Symposium on Security and Privacy, May 2014, pp.590-604. DOI: 10.1109/SP.2014.44.
Crossref
[8]
Chen H, Wagner D. MOPS: An infrastructure for examining security properties of software. In Proc. the 9th ACM Conference on Computer and Communications Security, Nov. 2002, pp.235-244. DOI: 10.1145/586110.586142.
Crossref
[9]
Yun I, Min C, Si X, Jang Y, Kim T, Naik M. APISan: Sanitizing API usages through semantic cross-checking. In Proc. the 25th USENIX Security Symposium, Aug. 2016, pp.363-378.
[10]
Son S, McKinley K S, Shmatikov V. RoleCast: Finding missing security checks when you do not know what checks are. In Proc. the 2011 ACM International Conference on Object Oriented Programming Systems Languages and Applications, Oct. 2011, pp.1069-1084. DOI: 10.1145/2048066.2048146.
Crossref
[11]
Yamaguchi F, Wressnegger C, Gascon H, Rieck K. Chucky: Exposing missing checks in source code for vulnerability discovery. In Proc. the 2013 ACM SIGSAC Conference on Computer and Communications Security, Nov. 2013, pp.499-510. DOI: 10.1145/2508859.2516665.
Crossref
[12]
Lu K, Pakki A, Wu Q. Detecting missing-check bugs via semantic- and context-aware criticalness and constraints inferences. In Proc. the 28th USENIX Security Symposium, Aug. 2019, pp.1769-1786.
[13]
Engler D, Chelf B, Chou A, Hallem S. Checking system rules using system-specific, programmer-written compiler extensions. In Proc. the 4th Symposium on Operating System Design and Implementation, Oct. 2000, pp.1-16.
Crossref
[14]

Engler D, Chen D Y, Hallem S, Chou A, Chelf B. Bugs as deviant behavior: A general approach to inferring errors in systems code. ACM SIGOPS Operating Systems Review, 2001, 35(5): 57-72. DOI: 10.1145/502059.502041.
Crossref Google Scholar
[15]
Brown F, Nötzli A, Engler D. How to build static checking systems using orders of magnitude less code. In Proc. the 21st International Conference on Architectural Support for Programming Languages and Operating Systems, April 2016, pp.143-157. DOI: 10.1145/2872362.2872364.
Crossref
[16]
Lu K, Pakki A, Wu Q. Automatically identifying security checks for detecting kernel semantic bugs. In Proc. the 2019 European Symposium on Research in Computer Security, Sept. 2019, pp.3-25. DOI: 10.1007/978-3-030-29962-0_1.
Crossref
[17]
Xu M, Qian C, Lu K, Backes M, Kim T. Precise and scalable detection of double-fetch bugs in OS kernels. In Proc. the 2018 IEEE Symposium on Security and Privacy, May 2018, pp.661-678. DOI: 10.1109/SP.2018.00017.
Crossref
[18]
Wang W, Lu K, Yew P C. Check it again: Detecting lacking-recheck bugs in OS kernels. In Proc. the 2018 ACM SIGSAC Conference on Computer and Communications Security, Oct. 2018, pp.1899-1913. DOI: 10.1145/3243734.3243844.
Crossref
[19]
Zhang T, Shen W, Lee D, Jung C, Azab A M, Wang R. PeX: A permission check analysis framework for Linux kernel. In Proc. the 28th USENIX Security Symposium, Aug. 2019, pp.1205-1220.
[20]
Gens D, Schmitt S, Davi L, Sadeghi A R. K-Miner: Uncovering memory corruption in Linux. In Proc. the 2018 Network and Distributed System Security Symposium, Feb. 2018. DOI: 10.14722/NDSS.2018.23326.
Crossref
[21]
Yan H, Sui Y, Chen S, Xue J. Machine-learning-guided typestate analysis for static use-after-free detection. In Proc. the 33rd Annual Computer Security Applications Conference, Dec. 2017, pp.42-54. DOI: 10.1145/3134600.3134620.
Crossref
[22]
Wang H, Xie X, Li Y, Wen C, Li Y, Liu Y, Sui Y. Typestate-guided fuzzer for discovering use-after-free vulnerabilities. In Proc. the 42nd IEEE/ACM International Conference on Software Engineering, July 2020, pp.999-1010. DOI: 10.1145/3377811.3380386.
Crossref
[23]

Gao Q, Zhang W, Chen Z, Zheng M, Qin F. 2ndStrike: Toward manifesting hidden concurrency typestate bugs. ACM SIGPLAN Notices, 2011, 46(3): 239-250. DOI: 10.1145/1961296.1950394.
Crossref Google Scholar
[24]
Marriott K, Stuckey P J, Sulzmann M. Resource usage verification. In Proc. the 1st Asian Symposium on Programming Languages and Systems, Nov. 2003, pp.212-229. DOI: 10.1007/978-3-540-40018-9_15.
Crossref
[25]

Xu Z, Wen C, Qin S. State-taint analysis for detecting resource bugs. Science of Computer Programming, 2018, 162: 93-109. DOI: 10.1016/j.scico.2017.06.010.
Crossref Google Scholar
Journal of Computer Science and Technology
Volume 36 Issue 6,
November 2021
Pages 1248-1268
DOI: 10.1007/s11390-021-1593-4
Cite this article:
Zhang G, Wang P-F, Yue T, et al. MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels. Journal of Computer Science and Technology, 2021, 36(6): 1248-1268. https://doi.org/10.1007/s11390-021-1593-4

381

Views

1

Crossref

1

Web of Science

1

Scopus

0

CSCD

Altmetrics
Received: 18 May 2021
Accepted: 25 August 2021
Published: 30 November 2021
© Institute of Computing Technology, Chinese Academy of Sciences 2021
Return