A method for identifying and protecting attackable data in a kernel file system

Abstract

The application discloses a kind of identification and protection method for attackable data in kernel file system, comprising: the source code of kernel file system is compiled as LLVM IR file, and different categories of core data are obtained by scanning based on the LLVM IR file, including file metadata, file content and file read-write direction;Based on the LLVM IR file, the data flow propagation and control flow propagation of the core data are tracked, and attackable non-control data is obtained;The attackable non-control data is dynamically verified to determine whether it is attackable data;The data finally affected by the attackable data in the disk is protected.The application is an automatic analysis tool for attack surface caused by attackable non-control data in Linux kernel file system, which can automatically identify potential attackable data according to semantic information, simulate the attack process, verify the validity of the data and identify the complete attack surface.

Description

Technical Field

[0001] This invention belongs to the field of operating system kernel protection, and in particular relates to a method for identifying and protecting against attackable data in the kernel file system. Background Technology

[0002] The Linux kernel is the foundation for computer operating systems and is widely used, including servers, personal computers, smartphones, and embedded systems. Because the security of the Linux kernel directly affects the security of numerous devices and systems, attacks and defenses against the operating system kernel have continuously evolved over the past few decades. Attack strategies have evolved from early kernel code injection attacks to code reuse attacks targeting control data (return addresses and function pointers), and finally to attacks targeting non-control data. Since various protection technologies have been proposed and deployed to defend against kernel code injection and code reuse attacks, attackers find it difficult to corrupt the kernel's code and control data, thus turning their attention to attacks targeting non-control data.

[0003] However, attacks on uncontrolled data rely on understanding program semantics, leaving significant room for research. For years, attackers have used various exploitable uncontrolled data to escalate privileges, such as page tables, credential data structures, and user-mode helper loading paths in the kernel. These sensitive data are often manually selected based on researchers' experience, lacking a systematic approach to identifying potential sensitive data. On the other hand, security researchers have proposed various protection techniques to monitor and protect this sensitive data. KENALI's research on the kernel uses a heuristic approach based on error codes to identify sensitive uncontrolled data; however, it only captures some privilege-checking-related sensitive data without studying its impact and exploitability. Many unknown uncontrolled data points remain, and their modification can lead to serious consequences, such as privilege escalation. A typical example is the Dirty Cow vulnerability (CVE-2016-5195), which exploits a race condition vulnerability to manipulate the state of uncontrolled data to write to read-only files, resulting in privilege escalation. The recently discovered Dirty Pipes vulnerability (CVE-2022-0847) exploits uninitialized uncontrolled data for privilege escalation.

[0004] However, this crucial non-control data remained undiscovered until real-world attacks occurred. A lack of systematic research to explore the exploitability of non-control data within the Linux kernel meant its attack surface remained unknown, and corresponding protective measures were lacking to defend against potential attacks. Unlike control data, which possesses explicit semantic information representing program jumps and execution logic, non-control data exhibits diverse semantics, and these semantics determine its potential for privilege escalation attacks. However, the kernel lacks documentation on the semantics of non-control data, and with continuous changes to the kernel code, it's virtually impossible to record the usage of all non-control data.

[0005] Therefore, an identification method is needed to analyze and obtain all data that can be used as attack targets, then summarize the patterns of the target data and provide protection schemes to effectively resist attacks on non-control data in the file system. Summary of the Invention

[0006] To address the shortcomings of existing technologies, the purpose of this application is to provide a method for identifying and protecting against attackable data in the kernel file system.

[0007] According to a first aspect of the embodiments of this application, a method for identifying and protecting against attackable data in a kernel file system is provided, comprising:

[0008] The source code of the kernel file system is compiled into an LLVM IR file, and different categories of core data, including file metadata, file content, and file read / write direction, are obtained by scanning based on the LLVM IR file.

[0009] Based on the LLVM IR file, the data flow propagation and control flow propagation of the core data are traced to obtain attackable non-control data;

[0010] The attackable non-control data is dynamically verified to determine whether it is attackable data.

[0011] Protect the data that is ultimately affected by the attackable data on the disk.

[0012] Furthermore, the data structure of permission data in the abstract file system layer is used as the file metadata, the data structure representing the file content in the page cache layer and the general block layer is used as the file content, and the read / write event uniformly recorded when data exchange is triggered in the general block layer is used to determine the file read / write direction.

[0013] Furthermore, value flow analysis based on type-based access paths is used to trace the data flow propagation and control flow propagation of the core data.

[0014] Furthermore, for core data in the form of flag variables, its data flow propagation includes direct assignment or assignment after logical operations, and in the control flow propagation, branch judgments affect the value of another flag variable.

[0015] Furthermore, for core data in pointer reference form, its data flow propagation includes both direct assignment operations and assignments after arithmetic operations.

[0016] Furthermore, the attackable non-controllable data is dynamically verified to determine whether it is attackable data, including:

[0017] Based on the uncontrolled data to be verified, the user-mode program performs a valid write operation on a file with write permissions, triggering the use code of the uncontrolled data in the kernel. The kernel instrumentation code automatically records the target value of the uncontrolled data and stores it in an array maintained by the kernel.

[0018] The user-mode program attempts to write the non-control data to a read-only file, triggering the kernel's code for using the non-control data. The kernel retrieves the target value of the non-control data from the array and writes it. At this point, the kernel relocates the data and automatically resets it to the value recorded in the previous step.

[0019] The user-space program rereads the read-only file to check if its content has been changed to the malicious content written in the previous step. If so, the data is vulnerable to attack.

[0020] According to a second aspect of the embodiments of this application, a device for identifying and protecting against attackable data in a kernel file system is provided, comprising:

[0021] The scanning module is used to compile the source code of the kernel file system into an LLVM IR file, and scan the LLVM IR file to obtain different categories of core data, including file metadata, file content and file read / write direction;

[0022] The tracing module is used to trace the data flow propagation and control flow propagation of the core data based on the LLVM IR file, and obtain attackable non-control data;

[0023] The dynamic verification module is used to dynamically verify the attackable non-control data and determine whether it is attackable data.

[0024] The protection module is used to protect the data ultimately affected by the attackable data on the disk.

[0025] According to a third aspect of the embodiments of this application, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the method described in the first aspect.

[0026] According to a fourth aspect of the embodiments of this application, an electronic device is provided, comprising:

[0027] One or more processors;

[0028] Memory, used to store one or more programs;

[0029] When the one or more programs are executed by the one or more processors, the one or more processors perform the method as described in the first aspect.

[0030] According to a fifth aspect of the embodiments of this application, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the steps of the method as described in the first aspect.

[0031] Compared to existing technologies, the technical innovations of this invention are: 1. A semantic-based non-control data classification method: Modeling the semantics of attackable non-control data in the file system, classifying it into different categories based on semantics, and filtering core data representing each category. 2. A static tracking technology for potentially attackable data: Statically tracking the propagation process of the core data representing each category, analyzing and obtaining all potential attackable data. 3. A dynamic simulation attack verification technology: Simulating attackers dynamically tampering with data values, automatically determining whether a privilege escalation attack has occurred, thus verifying whether the data is attackable and obtaining the attack surface caused by non-control data. 4. Protection technologies for different categories of data: Analyzing the file system hierarchy where data that can be used for privilege escalation attacks resides, and using different methods to protect the data according to the semantic-based categories in the first step. Therefore, the beneficial effects of this invention are:

[0032] 1) Automated and systematic analysis of vulnerable and uncontrolled data: This invention is the first automated analysis tool targeting the attack surface caused by vulnerable and uncontrolled data in the Linux kernel file system. This invention can automatically identify potentially vulnerable data based on semantic information, simulate attack processes, verify the validity of the data, and identify the complete attack surface.

[0033] 2) Low-performance data protection: After obtaining data that is effective against privilege escalation attacks, this invention designs different protection schemes for three types of data. Based on the different file system levels where the data is propagated, the data that is ultimately affected is selected as the protection target to reduce performance overhead.

[0034] 3) Compatible with drivers for multiple file systems and storage hardware: This invention automatically identifies vulnerable, uncontrolled data in various file system implementations, such as ext2, ext4, and FAT. Furthermore, it is compatible with different hardware, allowing for systematic analysis of hardware drivers without additional manual intervention.

[0035] 4) Cross-version support: The Linux kernel code updates and iterates very quickly. This invention can be ported to multiple versions of the Linux kernel without additional manual overhead. Based on source code analysis, it can be compatible with all mainstream system architectures (x86_64, aarch64, etc.).

[0036] Therefore, this invention has excellent prospects for widespread application.

[0037] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0038] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0039] Figure 1 This is a flowchart illustrating a method for identifying and protecting against attackable data in a kernel file system, according to an exemplary embodiment.

[0040] Figure 2 It is a diagram showing the hierarchical structure of the file system in the Linux kernel.

[0041] Figure 3 This is a flowchart illustrating the static extraction of core data and the tracking of its propagation according to an exemplary embodiment.

[0042] Figure 4 This is a flowchart illustrating dynamic verification of attackable, uncontrolled data according to an exemplary embodiment.

[0043] Figure 5 This is a flowchart illustrating the protection of vulnerable data according to an exemplary embodiment.

[0044] Figure 6 This is a block diagram illustrating an apparatus for identifying and protecting against attackable data in a kernel file system, according to an exemplary embodiment.

[0045] Figure 7 This is a schematic diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0046] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.

[0047] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0048] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0049] Figure 1 This is a flowchart illustrating a method for identifying and protecting against attackable data in a kernel file system, according to an exemplary embodiment. Figure 1 As shown, this method, when applied to a terminal, may include the following steps:

[0050] Step S1: Transfer the kernel file system ( Figure 2 The source code of the file is compiled into an LLVM IR file, and the core data of different categories are obtained by scanning the LLVM IR file, including file metadata, file content and file read / write direction. Figure 2 It shows the hierarchical structure of the file system in the Linux kernel, and lists a portion of dynamically verified data that can be used for privilege escalation attacks at each level.

[0051] Specifically, such as Figure 3 As shown, the kernel source code is compiled into an LLVM IR file that is easy to analyze, and then a static analysis tool is run to scan the non-control data, i.e., core data, representing different categories in certain specific layers of the file system.

[0052] The core data is mainly divided into file metadata, file content, and file read / write direction:

[0053] (1) File metadata: Attackers can bypass the top-level security checks of the file system by tampering with the permission information of file metadata, thereby gaining root privileges. For example... Figure 2 As shown, abstract file system layers (such as virtual file system layers and generic block layers) hide different implementations to provide an abstract interface. This module selects the data structure of the permission data of this layer to represent the metadata of the file.

[0054] (2) File Content: Represents the user data stored in the file, which can be stored in two ways: disk and memory (page cache). Attackers can modify non-control data and directly write to the content of read-only files to achieve privilege escalation attacks. For example, modifying the contents of / etc / passwd to add the attacker as the root user would achieve privilege escalation. Therefore, the data structure representing the file content should be chosen between the page cache layer and the general block layer, such as... Figure 2 As shown, this data structure is relatively independent of different file system implementations and disk hardware drivers.

[0055] (3) Read / Write Direction: File metadata and content are stored on the disk and loaded into memory when needed. Read and write operations run throughout the entire file system, from the top level down to the bottom level of the disk, enabling data exchange. The Linux kernel records unified data exchange events between the disk and main memory in the general block layer. By modifying the read / write flags, a read operation can be converted into a write operation, thus writing to a read-only file. Therefore, the unified record of read / write events triggered when data exchange is activated in the general block layer is chosen as the core data.

[0056] Step S2: Based on the LLVM IR file, trace the data flow propagation and control flow propagation of the core data to obtain attackable non-control data;

[0057] Specifically, such as Figure 3As shown, core data is used as the foundation for propagation, and its propagation process is tracked to uncover more attackable non-control data. The three types of data propagation modes are different. By customizing the propagation rules, the data flow and control flow of core data are tracked, and more potential attackable data is obtained through analysis. Specifically, the three types of core data have two forms of data structure in the code: (1) Flag variables, usually implemented by integers, whose values ​​mark a certain kernel state. Each bit of the flag variable represents a different state, so only logical operations (AND, OR, NOT) are performed, and no arithmetic operations (addition, subtraction, multiplication, and division) are performed. Therefore, in the data flow propagation process, the propagation algorithm only includes direct assignment or assignment after logical operations. In the control flow propagation, a flag variable can affect the value of another flag variable through branch judgment. For example, a specific bit of a flag variable representing permissions represents legal permissions. By judging the permissions through branch, if it is legal, the state of another flag variable is assigned to the legal state; otherwise, the state is marked as illegal. (2) Pointer references are used as indexes to find specific areas in the storage space. Unlike flag variables, whose different bits represent information hard-coded in the kernel and remain unchanged, allowing for easy retrieval of values ​​representing different states, a pointer references a dynamically changing value, depending on the location of the target memory space. A pointer's value is unique, pointing exclusively to a specific memory region. The data flow propagation process tracking pointer variables involves arithmetic operations (e.g., aligning a pointer) but not logical operations. Therefore, the data flow propagation rules include direct assignment operations and assignments after arithmetic operations. On the other hand, pointer values ​​are influenced by control flow. In branch conditions, the pointer's value is determined based on the state of the flag variable in the conditional statement, and then the flag variable is treated as the new data being propagated. This is because pointer variables typically do not appear in branch conditional statements; only flag variables appear to determine the kernel's state. The propagation rule for this state variable follows the first propagation rule (flag variable propagation). This propagation process is recursive until no new data is found.

[0058] The tracing process is also applied to LLVM IR files, avoiding costly pointer analysis through value flow analysis of type-based access paths (such as Practical program modularization with type-based dependence analysis and Statically Discovering High-Order Taint Style Vulnerabilities in OS Kernels).

[0059] Step S3: Dynamically verify the attackable non-control data to determine whether it is attackable data;

[0060] Specifically, step S2 yields a set of potentially vulnerable, uncontrolled data. To avoid mutual interference between data, this invention extracts one data point from the set at a time until all data has been verified. For example... Figure 4 As shown, instrumentation is required before dynamic verification. Dynamic verification consists of three steps and requires the use of an LLVM-instrumented kernel and user-space program. This invention instrumentes the location of all identified data in the kernel, but only extracts one piece of data for verification at a time. During kernel runtime, only the value of that data is recorded and reset. The function of the data to be extracted, as well as the functions of recording and resetting the data, are determined by a newly added system call. The user-space program triggers the instrumented kernel function by calling this system call, thereby achieving dynamic verification. Specifically, this invention defines a new system call whose parameters are: a certain piece of data to be verified, and the specific operation to be performed (including two types: record / reset). During the process of pre-instrumenting all data, all data are numbered, so the system call only needs to provide the number of the data to be verified; the parameters of the specific operation are distinguished by integers and used in steps S31-S32:

[0061] S31: Based on the specific data, the user-mode program performs a legal write operation on a file with write permissions, triggering the use code of the data in the kernel. The kernel instrumentation code automatically records the target value of the data and stores it in an array maintained by the kernel.

[0062] S32: A user-space program attempts to write malicious content to a read-only file, triggering the kernel's code that uses the data. The kernel retrieves the value from the array and writes it back into the data. At this point, the kernel relocates the data and automatically resets it to the value recorded in the previous step.

[0063] S33: The user-space program rereads the read-only file used in S32 to check if its content has been changed to the malicious content written in the previous step. If so, the data is attackable data and is collected into the attackable data set.

[0064] After performing steps S31-S33 above on all uncontrolled data in the attackable uncontrolled data set, report all data in the attackable data set, including the data structure on which the allocated data depends, a specific offset position in the structure, and modify the value at that offset position to the value recorded in step three, causing writing to a read-only file, thereby achieving privilege escalation attack and obtaining the attack surface of uncontrolled data in the kernel.

[0065] Step S4: Protect the data ultimately affected by the attackable data on the disk;

[0066] like Figure 5 As shown, analysis of all attackable data reveals data representing file content distributed at the lowest level of the kernel file system, i.e., on the disk. This part includes page caches representing file content and disk block data. It is worth noting that for file metadata and file read / write direction, the attacker's goal in bypassing permission checks is to write the target file content or modify the read / write direction to write the file content. Therefore, protecting only the file content data is sufficient to achieve comprehensive protection against uncontrolled data attacks targeting the file system.

[0067] This invention is the first to propose a systematic analysis of non-control data in the kernel that serves as a target for attacks. It automatically identifies data that causes privilege escalation attacks, summarizes the patterns of this data, and provides corresponding protection schemes. The scope of this analysis is the file system within the kernel, because files play a crucial role in kernel security. Once file access protection is compromised, attackers can easily launch privilege escalation attacks. Furthermore, the hierarchical structure of the file system is clear, facilitating the analysis of semantic information at different levels. Therefore, this invention first divides non-control data into multiple categories representing different semantics based on the multi-layered semantic structure of the file system; according to the characteristics of data semantics, it filters the core non-control data representing each category, then statically tracks the propagation process of its semantics to analyze and obtain all potentially attackable data in each category; dynamic instrumentation is used to automatically monitor and simulate the process of attackers tampering with attackable data, verifying and obtaining the data that truly causes privilege escalation attacks, such as... Figure 2 As shown, the identification results encompass all non-control data currently used by privilege escalation attacks, including Dirty Cow vulnerabilities (vm_fault->flags), Dirty Pipe vulnerabilities (pipe_buffer->flags), and Dirty Privilege vulnerabilities (file->f_mode); the final report covers all attackable non-control data, employing different protection schemes for different categories of data.

[0068] Corresponding to the aforementioned embodiments of the method for identifying and protecting against attackable data in the kernel file system, this application also provides embodiments of a device for identifying and protecting against attackable data in the kernel file system.

[0069] Figure 6 This is a block diagram illustrating an apparatus for identifying and protecting against attackable data in a kernel file system, according to an exemplary embodiment. (Refer to...) Figure 6 The device may include:

[0070] The scanning module 21 is used to compile the source code of the kernel file system into an LLVM IR file, and scan the LLVM IR file to obtain different categories of core data, including file metadata, file content and file read / write direction;

[0071] The tracing module 22 is used to trace the data flow propagation and control flow propagation of the core data based on the LLVM IR file to obtain attackable non-control data;

[0072] The dynamic verification module 23 is used to dynamically verify the attackable non-control data and determine whether it is attackable data.

[0073] Protection module 24 is used to protect the data that the attackable data ultimately affects on the disk.

[0074] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0075] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0076] Accordingly, this application also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the aforementioned method for identifying and protecting against attackable data in the kernel file system.

[0077] Accordingly, this application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the aforementioned method for identifying and protecting against attackable data in the kernel file system. Figure 7 The diagram shown is a hardware structure diagram of any data processing device located in an embodiment of the present invention, which provides a device for identifying and protecting against attackable data in the kernel file system. Except for... Figure 7 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0078] Accordingly, this application also provides a computer-readable storage medium storing computer instructions thereon, which, when executed by a processor, implement the aforementioned method for identifying and protecting against attackable data in the kernel file system. The computer-readable storage medium can be an internal storage unit of any data-processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data-processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data-processing device, and can also be used to temporarily store data that has been output or will be output.

[0079] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

Claims

1. A method for identifying and protecting against attackable data in a kernel file system, characterized in that, include: The source code of the kernel file system is compiled into an LLVM IR file, and different categories of core data, including file metadata, file content, and file read / write direction, are obtained by scanning based on the LLVM IR file. Based on the LLVM IR file, the data flow propagation and control flow propagation of the core data are traced to obtain attackable non-control data; The attackable non-control data is dynamically verified to determine whether it is attackable data. The data ultimately affected by the attackable data on the disk is protected. The data ultimately affected is data representing the file content, including page cache representing the file content and disk block data. The non-control data is divided into file metadata, file content, and file read / write direction. Dynamic verification is performed on the attackable non-control data to determine whether it is attackable, including: Based on the uncontrolled data to be verified, the user-mode program performs a valid write operation on a file with write permissions, triggering the use code of the uncontrolled data in the kernel. The kernel instrumentation code automatically records the target value of the uncontrolled data and stores it in an array maintained by the kernel. A user-space program attempts to write malicious content to a read-only file, triggering the kernel's code that uses the uncontrolled data. The kernel then retrieves the target value of the uncontrolled data from the array and writes it. At this point, the kernel relocates the data and automatically resets it to the value recorded in the previous step. The user-space program rereads the read-only file to check if its content has been changed to the malicious content written in the previous step. If so, the data is vulnerable to attack.

2. The method according to claim 1, characterized in that, The file metadata is obtained by using the data structure of permission data in the abstract file system layer, the file content is obtained by using the data structure representing the file content in the page cache layer and the general block layer, and the file read / write direction is determined by the read / write event uniformly recorded when data exchange is triggered in the general block layer.

3. The method according to claim 1, characterized in that, Value flow analysis based on type-based access paths is used to trace the data flow propagation and control flow propagation of the core data.

4. The method according to claim 1, characterized in that, For core data in the form of flag variables, its data flow propagation includes direct assignment or assignment after logical operations, and in the control flow propagation, it affects the value of another flag variable through branch judgment.

5. The method according to claim 1, characterized in that, For core data in pointer reference form, its data flow propagation includes direct assignment operations as well as assignments after arithmetic operations.

6. A device for identifying and protecting against attackable data in a kernel file system, characterized in that, include: The scanning module is used to compile the source code of the kernel file system into an LLVM IR file, and scan the LLVM IR file to obtain different categories of core data, including file metadata, file content and file read / write direction; The tracing module is used to trace the data flow propagation and control flow propagation of the core data based on the LLVM IR file, and obtain attackable non-control data; The dynamic verification module is used to dynamically verify the attackable non-control data and determine whether it is attackable data. The protection module is used to protect the data that the attackable data ultimately affects on the disk. The data that ultimately affects the data is data representing the file content, including page cache representing the file content and disk block data. The non-control data is divided into file metadata, file content, and file read / write direction. Dynamic verification is performed on the attackable non-control data to determine whether it is attackable, including: Based on the uncontrolled data to be verified, the user-mode program performs a valid write operation on a file with write permissions, triggering the use code of the uncontrolled data in the kernel. The kernel instrumentation code automatically records the target value of the uncontrolled data and stores it in an array maintained by the kernel. A user-space program attempts to write malicious content to a read-only file, triggering the kernel's code that uses the uncontrolled data. The kernel then retrieves the target value of the uncontrolled data from the array and writes it. At this point, the kernel relocates the data and automatically resets it to the value recorded in the previous step. The user-space program rereads the read-only file to check if its content has been changed to the malicious content written in the previous step. If so, the data is vulnerable to attack.

7. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the method as described in any one of claims 1-5.

8. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-5.

9. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, this instruction implements the steps of the method as described in any one of claims 1-5.

Images