A Root Canal Static Analysis Based Audit of Zephyr
summary
Zephyr 3.5.0 ships CodeChecker (10 linters incl clang static analyzer clang tidy CPPCheck Facebook Infer) but deeper audit by OpenRefactory finds more issues: Coverity: 77 reports Jan–Mar 2024 → 66 unique about 35 fixed (~50% fix rate) ~25% false positives 17 pending. Modern tools like semgrep and sneak produce lots of noise (semgrep 233 flags 231 false positives; sneak ~41 flags 27 false positives). Audit isolates repeated causes: unsafe C APIs (sprintf/strcpy) and buffer logic; one of 68 sprintf uses looks exploitable.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 4:45Static analysis approach
- 14:46Root canal analysis concept
- 17:15Coverity scanner results
- 25:41Medium severity bugs
- 26:01Zephyr CVEs overview
- 28:32Sprintf buffer overflow risks
- 32:02CodeChecker evaluation
- 33:24Snyk and Semgrep analysis
- 37:39Zephyr security assessment
- 39:02Persistent overflow challenges
- 43:25Q&A
related talks
47mA Root Canal Static Analysis Based Audit of Zephyr
46mInsights from Zephyr Security Audit and Vulnerability Experiences
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”
29m“The Current State of (free) Static Analysis"
18mSecuring Erlang and Elixir applications
57mSecurity Engineering: Zcash Ecosystem Security and Learning From Safety-Critical Disciplines
44mAn intro to improving the security of your code with free analysis tools
40mThe Zephyr Project Security Overview, Progress, and Status