Wei's Blog

1. Race Bug

两个访问内存区域的线程，当下面三个条件同时满足时，即可认定是Race bug。

1. 访问的内存区域地址相同
2. 其中一个内存访问是写操作
3. 两个线程的执行顺序是不受限制的

Abstract

Data races occur when two threads fail to use proper synchronization when accessing shared data. In kernel file systems, which are highly concurrent by design, data races are common mistakes and often wreak havoc on the users, causing inconsistent states or data losses. Prior fuzzing practices on file systems have been effective in uncovering hundreds of bugs, but they mostly focus on the sequential aspect of file system execution and do not comprehensively explore the concurrency dimension and hence, forgo the opportunity to catch data races.

Abstract

A data race in a kernel is an important class of bugs, critically impacting the reliability and security of the associated system. As a result of a race, the kernel may become unresponsive. Even worse, an attacker may launch a privilege escalation attack to acquire root privileges.

Abstract

Device drivers are an essential part in modern Unix-like systems to handle operations on physical devices, from hard disks and print- ers to digital cameras and Bluetooth speakers. The surge of new hardware, particularly on mobile devices, introduces an explosive growth of device drivers in system kernels. Many such drivers are provided by third-party developers, which are susceptible to se- curity vulnerabilities and lack proper vetting. Unfortunately, the complex input data structures for device drivers render traditional analysis tools, such as fuzz testing, less effective, and so far, research on kernel driver security is comparatively sparse.

Abstract

Discovering the security vulnerabilities of commercial off-the-shelf (COTS) operating systems (OSes) is chal- lenging because they not only are huge and complex, but also lack detailed debug information. Concolic testing, which generates all feasible inputs of a program by using symbolic execution and tests the program with the generated inputs, is one of the most promising approaches to solve this problem. Unfortunately, the state-of-the-art concolic testing tools do not scale well for testing COTS OSes because of state explosion. Indeed, they often fail to find a single bug (or crash) in COTS OSes despite their long execution time.

Abstract

Many kinds of memory safety vulnerabilities have been endangering software systems for decades. Amongst other approaches, fuzzing is a promising technique to unveil various software faults. Recently, feedback-guided fuzzing demonstrated its power, pro- ducing a steady stream of security-critical software bugs. Most fuzzing efforts—especially feedback fuzzing—are limited to user space components of an operating system (OS), although bugs in kernel components are more severe, because they allow an attacker to gain access to a system with full privileges. Unfortunately, kernel components are difficult to fuzz as feedback mechanisms (i.e., guided code coverage) cannot be easily applied. Additionally, non-determinism due to interrupts, kernel threads, statefulness, and similar mechanisms poses problems. Furthermore, if a process fuzzes its own kernel, a kernel crash highly impacts the performance of the fuzzer as the OS needs to reboot.

Several Cases

The following cases are concluded by the inspection of summaries/specifications generated by several tools.

• Android and Java Summaries: StubDroid, Modelgen, Apposcopy
• Javascript Summaries: Taser

1. How to decide Input and Output

   Basically, the inputs and outputs of a method are not only the parameters and return values, especially for those methods that take function callback as parameters.

   Read more »

Several Cases

The following cases are concluded by the inspection of summaries/specifications generated by several tools.

• Android and Java Summaries: StubDroid, Modelgen, Apposcopy
• Javascript Summaries: Taser

1. How to decide Input and Output

   Basically, the inputs and outputs of a method are not only the parameters and return values, especially for those methods that take function callback as parameters.

   Read more »

I would like to debug the following C program using gdb to check how to set the memory content to run this program statically using BinCAT.

I would like to debug the following C program using gdb to check how to set the memory content to run this program statically using BinCAT.