Detecting Callback Related Deep Vulnerabilities in Linux Device Drivers

No ratings

Presented at IEEESecDev 2019 by

Tuba Yavuz

Extensibility is an important design goal for software frameworks that are expected to evolve in a variety of dimensions. Callback mechanism is utilized extensivelyin large frameworks to achieve extensibility. However, callback mechanism introduces implicit control-flow dependenciesthat make program comprehension and analysis difficult. Thispaper presents an automated approach for detecting deepbugs/vulnerabilities that involve callbacks. Our approach consistsof several stages to balance scalability and precision. Specifically,it uses a light-weight static analysis for extracting callback relatedinteractions between the application modules and the frameworkmodules. This information is used to extend the basic call graphof the application modules to incorporate implicit call chains dueto callbacks. The second stage, summary mode, summarizes bugrelevant data-flow facts for paths that start at callbacks. Thethird stage, summary-aware mode, uses the extended call graphto incorporate data-flow facts due to implicit paths that leadto the callbacks and detects deep bugs. We have implementedthe presented model extraction and bug detection approachin a framework called MOXCAFE and applied it to Linuxdevice drivers. Using our approach, we could detect several deepvulnerabilities.