Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers
Talkat USENIX ATC '19 · on Wednesday, 2019-07-10· at 16:30· USENIX ATC Track II: Grand Ballroom VII–IX·
summary
Paper proposes DCUAF, a static analysis that combines local-global analysis to identify driver interface pairs that can run concurrently and then performs a summary-based lockset analysis with field-based aliasing and function summaries. Applied to Linux 4.19, it finds 640 real concurrency use-after-free bugs, randomly reports 130 and gets 95 confirmed. Alias analysis uses the whole-kernel call graph but pointer resolution and interprocedural summaries are mostly limited to per-driver code.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:33Concurrency
- 2:15Channels
- 3:05Outline
- 3:21Expla
- 3:57Network Errors
- 5:12Model
- 6:26Global Stage
- 7:39Summary Based Analysis
- 8:27Evaluation
- 8:49Results
- 9:32Positives
- 9:58Conclusions
related talks
31mHow Double-Fetch Situations turn into Double-Fetch Vulnerabilities...
20mDLOS: Effective Static Detection of Deadlocks in OS Kernels
36mA Hybrid Alias Analysis Framework and Its Application to Protecting the Linux Kernel
38mHow I started chasing speculative type confusion bugs in the kernel and ended up wi...
36mUnderstanding & explaining Use-After-Free vulnerability, a critical security flaw
32mEnhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis
24mNew Compat Vulnerabilities in Linux Device Drivers
54mCatching Real-time Safety Violations in C++