We use cookies to improve your experience with our site.
Advanced Search
Volume 36 Issue 6
November  2021
Turn off MathJax
Article Contents
Abstract
References
Related Articles
Supplements
Gen Zhang, Peng-Fei Wang, Tai Yue, Xu Zhou, Kai Lu. MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels[J]. Journal of Computer Science and Technology, 2021, 36(6): 1248-1268. DOI: 10.1007/s11390-021-1593-4
Citation: Gen Zhang, Peng-Fei Wang, Tai Yue, Xu Zhou, Kai Lu. MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels[J]. Journal of Computer Science and Technology, 2021, 36(6): 1248-1268. DOI: 10.1007/s11390-021-1593-4
shu

MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels

  • College of Computer, National University of Defense Technology, Changsha 410073, China

Funds: This work is supported by the National High-Level Personnel for Defense Technology Program of China under Grant No. 2017- JCJQ-ZQ-013, the National Natural Science Foundation of China under Grant Nos. 61902405 and 61902412, the Natural Science Foundation of Hunan Province of China under Grant No. 2021JJ40692, the Parallel and Distributed Processing Research Foundation under Grant No. 6142110190404, and the Research Project of National University of Defense Technology under Grant Nos. ZK20-09 and ZK20-17.
More Information
  • Received Date: May 17, 2021
  • Revised Date: August 24, 2021
  • Published Date: November 29, 2021
    Abstract
  • Allocation, dereferencing, and freeing of memory data in kernels are coherently linked. There widely exist real cases where the correctness of memory is compromised. This incorrectness in kernel memory brings about significant security issues, e.g., information leaking. Though memory allocation, dereferencing, and freeing are closely related, previous work failed to realize they are closely related. In this paper, we study the life-cycle of kernel memory, which consists of allocation, dereferencing, and freeing. Errors in them are called memory life-cycle (MLC) bugs. We propose an in-depth study of MLC bugs and implement a memory life-cycle bug sanitizer (MEBS) for MLC bug detection. Utilizing an interprocedural global call graph and novel identification approaches, MEBS can reveal memory allocation, dereferencing, and freeing sites in kernels. By constructing a modified define-use chain and examining the errors in the life-cycle, MLC bugs can be identified. Moreover, the experimental results on the latest kernels demonstrate that MEBS can effectively detect MLC bugs, and MEBS can be scaled to different kernels. More than 100 new bugs are exposed in Linux and FreeBSD, and 12 common vulnerabilities and exposures (CVE) are assigned.
    • FullText(HTML)
    • References (25)
  • [1]
    Akritidis P, Cadar C, Raiciu C, Costa M, Castro M. Preventing memory error exploits with WIT. In Proc. the 2008 IEEE Symposium on Security and Privacy, May 2008, pp.263-277. DOI: 10.1109/SP.2008.30.
    [2]
    Lee B, Song C, Kim T, Lee W. Type casting verification: Stopping an emerging attack vector. In Proc. the 24th USENIX Security Symposium, Aug. 2015, pp.81-96.
    [3]
    Szekeres L, Payer M, Wei T, Song D. SoK: Eternal war in memory. In Proc. the 2013 IEEE Symposium on Security and Privacy, May 2013, pp.48-62. DOI: 10.1109/SP.2013.13.
    [4]
    Xu J, Mu D, Chen P, Xing X, Wang P, Liu P. CREDAL: Towards locating a memory corruption vulnerability with your core dump. In Proc. the 2016 ACM SIGSAC Conference on Computer and Communications Security, Oct. 2016, pp.529-540. DOI: 10.1145/2976749.2978340.
    [5]
    Zhang G. Detecting memory life-cycle bugs with extended define-use chain analysis. IEEE Access, 2020, 8: 114968-114980. DOI: 10.1109/ACCESS.2020.2999351.
    [6]
    He B, Rastogi V, Cao Y, Chen Y, Venkatakrishnan V N, Yang R, Zhang Z. Vetting SSL usage in applications with SSLINT. In Proc. the 2015 IEEE Symposium on Security and Privacy, May 2015, pp.519-534. DOI: 10.1109/SP.2015.38.
    [7]
    Yamaguchi F, Golde N, Arp D, Rieck K. Modeling and discovering vulnerabilities with code property graphs. In Proc. the 2014 IEEE Symposium on Security and Privacy, May 2014, pp.590-604. DOI: 10.1109/SP.2014.44.
    [8]
    Chen H, Wagner D. MOPS: An infrastructure for examining security properties of software. In Proc. the 9th ACM Conference on Computer and Communications Security, Nov. 2002, pp.235-244. DOI: 10.1145/586110.586142.
    [9]
    Yun I, Min C, Si X, Jang Y, Kim T, Naik M. APISan: Sanitizing API usages through semantic cross-checking. In Proc. the 25th USENIX Security Symposium, Aug. 2016, pp.363-378.
    [10]
    Son S, McKinley K S, Shmatikov V. RoleCast: Finding missing security checks when you do not know what checks are. In Proc. the 2011 ACM International Conference on Object Oriented Programming Systems Languages and Applications, Oct. 2011, pp.1069-1084. DOI: 10.1145/2048066.2048146.
    [11]
    Yamaguchi F, Wressnegger C, Gascon H, Rieck K. Chucky: Exposing missing checks in source code for vulnerability discovery. In Proc. the 2013 ACM SIGSAC Conference on Computer and Communications Security, Nov. 2013, pp.499-510. DOI: 10.1145/2508859.2516665.
    [12]
    Lu K, Pakki A, Wu Q. Detecting missing-check bugs via semantic-and context-aware criticalness and constraints inferences. In Proc. the 28th USENIX Security Symposium, Aug. 2019, pp.1769-1786.
    [13]
    Engler D, Chelf B, Chou A, Hallem S. Checking system rules using system-specific, programmer-written compiler extensions. In Proc. the 4th Symposium on Operating System Design and Implementation, Oct. 2000, pp.1-16.
    [14]
    Engler D, Chen D Y, Hallem S, Chou A, Chelf B. Bugs as deviant behavior: A general approach to inferring errors in systems code. ACM SIGOPS Operating Systems Review, 2001, 35(5): 57-72. DOI: /10.1145/502059.502041.
    [15]
    Brown F, Nötzli A, Engler D. How to build static checking systems using orders of magnitude less code. In Proc. the 21st International Conference on Architectural Support for Programming Languages and Operating Systems, April 2016, pp.143-157. DOI: 10.1145/2872362.2872364.
    [16]
    Lu K, Pakki A, Wu Q. Automatically identifying security checks for detecting kernel semantic bugs. In Proc. the 2019 European Symposium on Research in Computer Security, Sept. 2019, pp.3-25. DOI: 10.1007/978-3-030-29962-01.
    [17]
    Xu M, Qian C, Lu K, Backes M, Kim T. Precise and scalable detection of double-fetch bugs in OS kernels. In Proc. the 2018 IEEE Symposium on Security and Privacy, May 2018, pp.661-678. DOI: 10.1109/SP.2018.00017.
    [18]
    Wang W, Lu K, Yew P C. Check it again: Detecting lacking-recheck bugs in OS kernels. In Proc. the 2018 ACM SIGSAC Conference on Computer and Communications Security, Oct. 2018, pp.1899-1913. DOI: 10.1145/3243734.3243844.
    [19]
    Zhang T, Shen W, Lee D, Jung C, Azab A M, Wang R. PeX: A permission check analysis framework for Linux kernel. In Proc. the 28th USENIX Security Symposium, Aug. 2019, pp.1205-1220.
    [20]
    Gens D, Schmitt S, Davi L, Sadeghi A R. K-Miner: Uncovering memory corruption in Linux. In Proc. the 2018 Network and Distributed System Security Symposium, Feb. 2018. DOI: 10.14722/NDSS.2018.23326.
    [21]
    Yan H, Sui Y, Chen S, Xue J. Machine-learningguided typestate analysis for static use-after-free detection. In Proc. the 33rd Annual Computer Security Applications Conference, Dec. 2017, pp.42-54. DOI: 10.1145/3134600.3134620.
    [22]
    Wang H, Xie X, Li Y, Wen C, Li Y, Liu Y, Sui Y. Typestateguided fuzzer for discovering use-after-free vulnerabilities. In Proc. the 42nd IEEE/ACM International Conference on Software Engineering, July 2020, pp.999-1010. DOI: 10.1145/3377811.3380386.
    [23]
    Gao Q, Zhang W, Chen Z, Zheng M, Qin F. 2ndStrike: Toward manifesting hidden concurrency typestate bugs. ACM SIGPLAN Notices, 2011, 46(3): 239-250. DOI: 10.1145/1961296.1950394.
    [24]
    Marriott K, Stuckey P J, Sulzmann M. Resource usage verification. In Proc. the 1st Asian Symposium on Programming Languages and Systems, Nov. 2003, pp.212-229. DOI: 10.1007/978-3-540-40018-915.
    [25]
    Xu Z, Wen C, Qin S. State-taint analysis for detecting resource bugs. Science of Computer Programming, 2018, 162: 93-109. DOI: 10.1016/j.scico.2017.06.010.
    • Relative Articles

  • Related Articles

    [1]Xiao Chen, Le-Tian Sha, Fu Xiao, Jia-Ye Pan, Jian-Kuo Dong. AB-DHD: An Attention Mechanism and Bi-Directional Gated Recurrent Unit Based Model for Dynamic Link Library Hijacking Vulnerability Discovery[J]. Journal of Computer Science and Technology, 2025, 40(3): 887-903. DOI: 10.1007/s11390-025-4497-x
    [2]Wen-Jie Li, Jun Ma, Yan-Yan Jiang, Chang Xu, Xiao-Xing Ma. Understanding and Detecting Inefficient Image Displaying Issues in Android Apps[J]. Journal of Computer Science and Technology, 2024, 39(2): 434-459. DOI: 10.1007/s11390-022-1670-3
    [3]Ling-Yun Situ, Zhi-Qiang Zuo, Le Guan, Lin-Zhang Wang, Xuan-Dong Li, Jin Shi, Peng Liu. Vulnerable Region-Aware Greybox Fuzzing[J]. Journal of Computer Science and Technology, 2021, 36(5): 1212-1228. DOI: 10.1007/s11390-021-1196-0
    [4]Gökçer Peynirci, Mete Eminaǧaoǧlu, Korhan Karabulut. Feature Selection for Malware Detection on the Android Platform Based on Differences of IDF Values[J]. Journal of Computer Science and Technology, 2020, 35(4): 946-962. DOI: 10.1007/s11390-020-9323-x
    [5]Ling-Yun Situ, Lin-Zhang Wang, Yang Liu, Bing Mao, Xuan-Dong Li. Automatic Detection and Repair Recommendation for Missing Checks[J]. Journal of Computer Science and Technology, 2019, 34(5): 972-992. DOI: 10.1007/s11390-019-1955-3
    [6]Ji Wang, Xiao-Dong Ma, Wei Dong, Hou-Feng Xu, Wan-Wei Liu. Demand-Driven Memory Leak Detection Based on Flow- and Context-Sensitive Pointer Analysis[J]. Journal of Computer Science and Technology, 2009, 24(2): 347-356.
    [7]ZHANG WenHui. Combining Static Analysis and Case-Based Search Space Partitioning for Reducing Peak Memory in Model Checking[J]. Journal of Computer Science and Technology, 2003, 18(6).
    [8]Alberto Rocha, TONG Fu, YAN Zhuangzhi. A Logic Filter for Tumor Detection on Mammograms[J]. Journal of Computer Science and Technology, 2000, 15(6): 629-632.
    [9]Huang Zhiyi, Hu Shouren. Detection of And-Parallelism in Logic Programs[J]. Journal of Computer Science and Technology, 1990, 5(4): 379-387.
    [10]Hou Luoming. A General and Formal Method for the Program Static Analysis[J]. Journal of Computer Science and Technology, 1987, 2(2): 115-123.
    • Supplements (2)

  • Others

Catalog

    Get Citation
    PDF
    XML
    Read Online
    Article views (80) PDF downloads (0) Cited by()
    Related

    /

    DownLoad:  Full-Size Img  PowerPoint
    Return
    Return