| 摘要: |
| Use-after-free （UAF）漏洞是多线程程序的常见并发缺陷.预测性UAF漏洞检测方法因兼顾误报率和漏报率而备受关注.然而，已有的预测性UAF检测方法未结合待检测目标作针对性优化，当程序规模大或行为复杂时会导致检测效率低下.为了解决上述问题，提出一种目标导向的多线程程序UAF漏洞检测方法.首先，由程序运行轨迹挖掘程序的Petri网模型；之后，针对每一个潜在可构成UAF漏洞的内存Free/Use操作对，以触发该漏洞为目标导向，在程序的Petri网模型中添加保持操作间因果约束和数据一致性的行为控制结构；在此基础上，设计了一种基于Petri网反向展开的UAF漏洞检测方法.该方法每次只针对1个潜在的UAF漏洞，有针对性地验证其真实性，从而保证检测的效率.与此同时，为了减少待检测的潜在UAF漏洞数量，提出了一种新型向量时钟进行Free操作与Use操作间的因果关系自动识别，据此对潜在的UAF漏洞进行筛选.结合多个程序实例对所提方法进行了实验评估.实验结果表明，所提方法在检测的效率和准确性方面较主流方法有所提高. |
| 关键词: 软件验证 并发漏洞 Petri网 UAF漏洞 反向展开 |
| DOI：10.13328/j.cnki.jos.006862 |
| 分类号: |
| 基金项目:国家自然科学基金（61602279）；山东省泰山学者工程专项基金（ts20190936）；山东省高等学校青创科技支持计划（2019KJN024）；山东省自然科学基金智慧计算联合基金（ZR2021LZH004）；青岛市西海岸新区2022年“揭榜挂帅”技术攻关项目 |
|
| Target-oriented UAF Vulnerability Prediction Method of Multi-threaded Programs |
|
LU Fa-Ming1, TANG Meng-Fan1, BAO Yun-Xia2, ZENG Qing-Tian1, LI Yan-Cheng3
|
|
1.College of Computer Science and Engineering, Shandong University of Science and Technology, Qingdao 266590, China;2.College of Mathematics and Systems Science, Shandong University of Science and Technology, Qingdao 266590, China;3.Baidu Online Network Technology (Beijing) Co., Ltd., Beijing 100193, China
|
| Abstract: |
| Use-after-free (UAF) vulnerability is a common concurrency defect in multi-threaded programs. Predictive UAF vulnerability detection methods have attracted much attention for their balance of false positives and misses. However, existing predictive UAF detection methods are not optimized for the target to be detected, which leads to unacceptable detection efficiency when the program is large or has complex behavior. To address the issue, proposes a target-oriented method to detect UAF vulnerabilities in multi-threaded programs. Firstly, the Petri net model of the program is mined from the program traces. Then, for each potential memory Free and Use operation pair that could constitute a UAF vulnerability. To add behavioural control structures that maintains causal constrains and data consistency between operations to the Petri net model of the program, with the target of triggering the vulnerability. On this basis, a UAF vulnerability detection method based on Petri net reverse unfolding is designed. This method verifies the authenticity of only one potential UAF vulnerability at a time, thus ensuring the efficiency of detection. This method verifies the validity of one potential UAF vulnerability at a time, thus ensuring the efficiency of detection. At the same time, in order to reduce the number of potential UAF vulnerabilities to be detected, a new vector clock is proposed in this paper to automatically identify the causal relationship between Free and Use operations, and to filter the potential UAF vulnerabilities accordingly. The proposed method is experimentally evaluated with several program examples. The experimental results show that the proposed method improves the efficiency and accuracy of detection compared to the mainstream methods. |
| Key words: software verification concurrency vulnerability Petri net UAF vulnerability reverse unfolding |
