Efficient method and device for judging reuse vulnerabilities after software program release

Abstract

The invention discloses an efficient method and device for judging reuse vulnerability after software program release. The method mainly comprises the following steps: (1) enabling a program to crashin a running process by utilizing a known vulnerability triggering sample, and recording all executed instructions from the start of running of the program to the occurrence of crash; (2) recording all heap management operation behaviors in real time according to a calling condition of a system function in a program running process; (3) adopting a reverse dynamic taint propagation technology, andperforming forward backtracking on a propagation instruction set related to the crash instruction from the time when the program crashes; and (4) carrying out association analysis, finding out an object assignment moment related to the crash instruction, finding out a corresponding object allocation and release period on the basis of the object assignment moment, further judging whether the objectis released when crash occurs, and if yes, indicating that a reuse vulnerability after release exists. According to the method, the detection and protection capability of the released reuse vulnerability in the actual environment can be improved.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an efficient method and device for judging vulnerabilities of reused software programs after release. Background technique [0002] Although the current fuzz testing technology can discover a large number and variety of software vulnerabilities more and more quickly, the reuse-after-free vulnerability is currently recognized as the most common and most exploitable type of vulnerability. , making this type of vulnerability extremely powerful in destroying network and system security. Although there are many schemes for the detection and determination of reuse-after-free vulnerabilities, the common feature of these schemes is that they need to start from the normal execution of the program and record the dynamic allocation, use, release, and reallocation of a large number of objects. The detection and judgment efficiency of the reuse-after-free vulnerability i...

AI Technical Summary

Problems solved by technology

[0007] Aiming at the efficiency of existing software program reuse vulnerability determination methods after release and the dependence on the heap manager, the purpose of the present invention is to propose an efficient software program reuse vulnerability determination method after release, which is applicable to binary code and source code, through Dynamic monitoring of instruction records, crash instructions, and heap operation-related behaviors during program running, and reverse-backtracking analysis starting from crash instructions, so as to complete the efficient detection of reuse-after-free vulnerabilities

Images