Buffer overrun detection using linear programming and static analysis

Authors:
Vinod Ganapathy;Somesh Jha;David Chandler;David Melski;David Vitek
Affiliations:
University of Wisconsin-Madison;University of Wisconsin-Madison;Grammatech Inc., Ithaca, NY;Grammatech Inc., Ithaca, NY;Grammatech Inc., Ithaca, NY
Venue:
Proceedings of the 10th ACM conference on Computer and communications security
Year:
2003

Citing 20
Cited 25

Theory of linear and integer programming

Theory of linear and integer programming
Interprocedural slicing using dependence graphs

ACM Transactions on Programming Languages and Systems (TOPLAS)
Efficiently computing static single assignment form and the control dependence graph

ACM Transactions on Programming Languages and Systems (TOPLAS)
Speeding up slicing

SIGSOFT '94 Proceedings of the 2nd ACM SIGSOFT symposium on Foundations of software engineering
Presolving in linear programming

Mathematical Programming: Series A and B
Primal-dual interior-point methods

Primal-dual interior-point methods
Pointer analysis for programs with structures and casting

Proceedings of the ACM SIGPLAN 1999 conference on Programming language design and implementation
Symbolic bounds analysis of pointers, array indices, and accessed memory regions

PLDI '00 Proceedings of the ACM SIGPLAN 2000 conference on Programming language design and implementation
ABCD: eliminating array bounds checks on demand

PLDI '00 Proceedings of the ACM SIGPLAN 2000 conference on Programming language design and implementation
CCured: type-safe retrofitting of legacy code

POPL '02 Proceedings of the 29th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Introduction to Algorithms

Introduction to Algorithms
CSSV: towards a realistic tool for statically detecting all buffer overflows in C

PLDI '03 Proceedings of the ACM SIGPLAN 2003 conference on Programming language design and implementation
CCured in the real world

PLDI '03 Proceedings of the ACM SIGPLAN 2003 conference on Programming language design and implementation
RAD: A Compile-Time Solution to Buffer Overflow Attacks

ICDCS '01 Proceedings of the The 21st International Conference on Distributed Computing Systems
Static analysis and computer security: new techniques for software assurance

Static analysis and computer security: new techniques for software assurance
ARCHER: using symbolic, path-sensitive analysis to detect memory access errors

Proceedings of the 9th European software engineering conference held jointly with 11th ACM SIGSOFT international symposium on Foundations of software engineering
Statically detecting likely buffer overflow vulnerabilities

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
PointguardTM: protecting pointers from buffer overflow vulnerabilities

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
High coverage detection of input-related security facults

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
StackGuard: automatic adaptive detection and prevention of buffer-overflow attacks

SSYM'98 Proceedings of the 7th conference on USENIX Security Symposium - Volume 7

Consistency analysis of authorization hook placement in the Linux security modules framework

ACM Transactions on Information and System Security (TISSEC)
Secure program execution via dynamic information flow tracking

ASPLOS XI Proceedings of the 11th international conference on Architectural support for programming languages and operating systems
An efficient and backwards-compatible transformation to ensure memory safety of C programs

Proceedings of the 12th ACM SIGSOFT twelfth international symposium on Foundations of software engineering
Automatic detection and correction of programming faults for software applications

Journal of Systems and Software
String analysis for x86 binaries

PASTE '05 Proceedings of the 6th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering
SAFECode: enforcing alias analysis for weakly typed languages

Proceedings of the 2006 ACM SIGPLAN conference on Programming language design and implementation
Backwards-compatible array bounds checking for C with very low overhead

Proceedings of the 28th international conference on Software engineering
The case for analysis preserving language transformation

Proceedings of the 2006 international symposium on Software testing and analysis
Protecting against unexpected system calls

SSYM'05 Proceedings of the 14th conference on USENIX Security Symposium - Volume 14
Predicting vulnerable software components

Proceedings of the 14th ACM conference on Computer and communications security
Flow-insensitive static analysis for detecting integer anomalies in programs

SE'07 Proceedings of the 25th conference on IASTED International Multi-Conference: Software Engineering
AutoISES: automatically inferring security specifications and detecting violations

SS'08 Proceedings of the 17th conference on Security symposium
Detection of Security Vulnerabilities Using Guided Model Checking

ICLP '08 Proceedings of the 24th International Conference on Logic Programming
Symbolic String Verification: Combining String Analysis and Size Analysis

TACAS '09 Proceedings of the 15th International Conference on Tools and Algorithms for the Construction and Analysis of Systems: Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2009,
SoftBound: highly compatible and complete spatial memory safety for c

Proceedings of the 2009 ACM SIGPLAN conference on Programming language design and implementation
Loop-extended symbolic execution on binary programs

Proceedings of the eighteenth international symposium on Software testing and analysis
Architectural support for low overhead detection of memory violations

Proceedings of the Conference on Design, Automation and Test in Europe
Points-to analysis as a system of linear equations

SAS'10 Proceedings of the 17th international conference on Static analysis
Practical and effective symbolic analysis for buffer overflow detection

Proceedings of the eighteenth ACM SIGSOFT international symposium on Foundations of software engineering
Static analysis of string manipulations in critical embedded c programs

SAS'06 Proceedings of the 13th international conference on Static Analysis
Using static program analysis to aid intrusion detection

DIMVA'06 Proceedings of the Third international conference on Detection of Intrusions and Malware & Vulnerability Assessment
Detecting memory access errors with flow-sensitive conditional range analysis

ICESS'05 Proceedings of the Second international conference on Embedded Software and Systems
SWIPE: eager erasure of sensitive data in large scale systems software

Proceedings of the second ACM conference on Data and Application Security and Privacy
Mitigating program security vulnerabilities: Approaches and challenges

ACM Computing Surveys (CSUR)
Scalable and incremental software bug detection

Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper addresses the issue of identifying buffer overrun vulnerabilities by statically analyzing C source code. We demonstrate a light-weight analysis based on modeling C string manipulations as a linear program. We also present fast, scalable solvers based on linear programming, and demonstrate techniques to make the program analysis context sensitive. Based on these techniques, we built a prototype and used it to identify several vulnerabilities in popular security critical applications.