Automatically patching errors in deployed software

  • Authors:

  • Jeff H. Perkins;Sunghun Kim;Sam Larsen;Saman Amarasinghe;Jonathan Bachrach;Michael Carbin;Carlos Pacheco;Frank Sherwood;Stelios Sidiroglou;Greg Sullivan;Weng-Fai Wong;Yoav Zibin;Michael D. Ernst;Martin Rinard

  • Affiliations:

  • MIT, Cambridge, MA, USA;HKUST, Hong Kong, MA, USA;VMWare, Redwood, MA, USA;MIT, Cambridge, MA, USA;MIT, Cambridge, MA, USA;MIT, Cambridge, MA, USA;MIT, Cambridge, MA, USA;None, Scottsville, VA, USA;MIT, Cambridge, MA, USA;BAE, Burlington, MA, USA;NUS, Singapore, MA, Singapore;Come2Play, Haifa, MA, Israel;Washington University, Seattle, WA, USA;MIT, Cambridge, MA, USA

  • Venue:
  • Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles
  • Year:
  • 2009

Quantified Score

Hi-index 0.02

Visualization

Abstract

We present ClearView, a system for automatically patching errors in deployed software. ClearView works on stripped Windows x86 binaries without any need for source code, debugging information, or other external information, and without human intervention. ClearView (1) observes normal executions to learn invariants thatcharacterize the application's normal behavior, (2) uses error detectors to distinguish normal executions from erroneous executions, (3) identifies violations of learned invariants that occur during erroneous executions, (4) generates candidate repair patches that enforce selected invariants by changing the state or flow of control to make the invariant true, and (5) observes the continued execution of patched applications to select the most successful patch. ClearView is designed to correct errors in software with high availability requirements. Aspects of ClearView that make it particularly appropriate for this context include its ability to generate patches without human intervention, apply and remove patchesto and from running applications without requiring restarts or otherwise perturbing the execution, and identify and discard ineffective or damaging patches by evaluating the continued behavior of patched applications. ClearView was evaluated in a Red Team exercise designed to test its ability to successfully survive attacks that exploit security vulnerabilities. A hostile external Red Team developed ten code injection exploits and used these exploits to repeatedly attack an application protected by ClearView. ClearView detected and blocked all of the attacks. For seven of the ten exploits, ClearView automatically generated patches that corrected the error, enabling the application to survive the attacks and continue on to successfully process subsequent inputs. Finally, the Red Team attempted to make Clear-View apply an undesirable patch, but ClearView's patch evaluation mechanism enabled ClearView to identify and discard both ineffective patches and damaging patches.