An android system heap overflow vulnerability verification method and device

Abstract

The invention provides a heap overflow vulnerability verification method and apparatus for an Android system. The apparatus comprises a vulnerability detection module, an utilization judgment module and an utilization verification module, wherein the vulnerability detection module is used for filling a heap buffer area with a first input sample and detecting whether heap overflow occurs or not to determine existence of a heap overflow vulnerability; the utilization judgment module is used for filling the heap buffer area with a second input sample according to a result of the vulnerability detection module and triggering crash of a system process of the Android system through an executive vulnerability to determine a possibility that the heap overflow vulnerability is utilized; and the utilization verification module is used for filling the heap buffer area with a third input sample according to a result of the utilization judgment module and controlling an executive process of the system process of the Android system through the executive vulnerability to verify the utilizability of the heap overflow vulnerability. According to the method and the apparatus, whether the Android system has a specific heap overflow vulnerability or not and whether the heap overflow vulnerability can be utilized by an attacker or not can be effectively judged, and the security risk of the Android system due to the heap overflow vulnerability can be assessed, so that the system security is improved.

Description

technical field [0001] The present invention relates to the technical field of information security, and relates to a method for verifying a heap overflow vulnerability of an operating system of a mobile intelligent terminal, and more specifically, to a method for verifying a heap overflow vulnerability of an Android system. Background technique [0002] With the rapid development of the mobile Internet, the Android system has become the mobile smart terminal operating system with the highest market share in the world. Smart devices based on the Android system, as a medium for users' daily social communication and mobile office, store a large amount of user privacy information and sensitive data, so they are easy to become the main target of malicious attacks. [0003] In recent years, the Android system has continuously exposed various vulnerabilities, seriously affecting the security of the system itself, and threatening the data, business and code security of the upper-la...

AI Technical Summary

Problems solved by technology

This scheme verifies the stack overflow vulnerability of binary software. The implementation mechanism and memory layout of the stack memory space and the heap memory space are very different, so this scheme is not suitable for the heap overflow vulnerability.

Images