2009 · 167 citations · 16 references
ComputingComputer EngineeringComputer ScienceCompilersComputer SecurityVulnerability AnalysisControl-flow AnalysisData-flow AnalysisReverse Engineering For Vulnerability DiscoveryStatic Vulnerability AnalysisSymbolic ExecutionVulnerability ManagementBinary Control-flow AnalysisInteger OverflowInteger Overflow AnalysisInteger Overflow DetectionInteger Overflow VulnerabilitiesProgram Taint AnalysisSymbolic Execution For Vulnerability DiscoverySymbolic Execution Of Binaries
The number of identified integer overflow vulnerabilities has been increasing rapidly in recent years. This paper presents IntScope, a system that automatically detects integer overflow vulnerabilities in x86 binaries before attackers can exploit them, aiming to eliminate such vulnerabilities. IntScope translates disassembled code into an intermediate representation and performs path‑sensitive data‑flow analysis using symbolic execution and taint analysis to pinpoint integer overflows, avoiding binary execution and enabling scalability to large software. Experimental results show IntScope detected more than 20 zero‑day integer overflows (e.g., CVE‑2008‑4201, FrSIRT/ADV‑2008‑2919) in widely‑used software such as QEMU, Xen and Xine.
The number of identified integer overflow vulnerabilities has been increasing rapidly in recent years. In this paper, we present a system, IntScope, which can automatically detect integer overflow vulnerabilities in x86 binaries before an attacker does, with the goal of finally eliminating the vulnerabilities. IntScope first translates the disassembled code into our own intermediate representation (IR), and then performs a path sensitive data flow analysis on the IR by leveraging symbolic execution and taint analysis to identify the vulnerable point of integer overflow. Compared with other approaches, IntScope does not run the binary directly, and is scalable to large software as it can just symbolically execute the interesting program paths. Experimental results show IntScope is quite encouraging: it has detected more than 20 zero-day integer overflows (e.g., CVE-2008-4201, FrSIRT/ADV-2008-2919) in widely-used software such as QEMU, Xen and Xine.
16
Patrice Godefroid, Nils Klarlund, Koushik Sen · ACM SIGPLAN Notices · 2005 · 2.1K citations
Koushik Sen, Darko Marinov, Gul Agha · 2005 · 1.7K citations
Automated Whitebox Fuzz Testing.
Patrice Godefroid, Michael Y. Levin, David A. Molnar · 2008 · 1.1K citations
Cristian Cadar, Vijay Ganesh, Peter M. Pawlowski et al. · 2006 · 789 citations