Code vulnerability detection method and device, equipment and medium

Abstract

The invention provides a code vulnerability detection method and device, equipment and a medium, and the method comprises the steps: disassembling a to-be-detected code, and obtaining an intermediate language code; constructing an original data dependency graph corresponding to the to-be-detected code; traversing the intermediate language code, determining a target function called in the intermediate language code, and updating the original data dependency graph to obtain a target data dependency graph; traversing each node in the target data dependency graph to determine a target node with vulnerabilities from a plurality of nodes in the target data dependency graph; and performing conditional competition vulnerability detection on a target variable corresponding to the target node, and performing vulnerability detection after release to obtain a vulnerability detection result of the to-be-detected code. Through the method and the device, the vulnerability problem of use and condition competition after release in the code is effectively detected, and the accuracy and the efficiency of code vulnerability detection are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment and medium for detecting code vulnerabilities. Background Art

[0002] At present, application software and IoT devices have become an indispensable part of daily life, including in work scenarios. As more and more embedded devices are connected to the Internet, user convenience has been significantly improved, but also faces severe security challenges.

[0003] The operating system of an embedded device usually relies on a type of software called "firmware" to run. Firmware can be considered as "built-in software" and refers to software programs that are programmed into a programmable read-only memory (such as Flash). Because firmware code usually enjoys high execution permissions, potential defects or vulnerabilities within it are often difficult to detect.

[0004] For example, issues such as insufficient consideration of buffer boundaries or insufficient validation of input parameters can be addressed through static program analysis techniques (such as taint analysis). However, for vulnerabilities caused by program protocol interactions or function call timing, existing static taint analysis techniques do not fully consider the relevance of function call contexts under different execution timings, making it difficult to accurately identify these vulnerabilities. Summary of the invention

[0005] In view of this, the purpose of the present application is to provide a code vulnerability detection method, detection device, equipment and medium, which can effectively detect the vulnerability problems of post-free use and conditional competition in the code, thereby improving the accuracy and efficiency of code vulnerability detection.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting a code vulnerability, the detection method comprising: Obtaining the code to be detected, and disassembling the code to be detected to obtain an intermediate language code; Constructing an original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code; Traversing the intermediate language code, determining the target function called in the intermediate language code, and updating the original data dependency graph based on the target function to obtain a target data dependency graph; wherein the target function is a timing creation function and a lock function; Traversing each node in the target data dependency graph to determine a target node with a vulnerability from a plurality of nodes in the target data dependency graph; A conditional competition vulnerability detection and a use-after-free vulnerability detection are performed on the target variable corresponding to the target node to obtain a vulnerability detection result of the code to be detected.

[0007] Further, when the objective function is a time series creation function, the updating of the original data dependency graph based on the objective function to obtain a target data dependency graph includes: Determining a first variable involved in the objective function from the intermediate language code; A branch is created on the node corresponding to the first variable in the original data dependency graph to obtain the target data dependency graph.

[0008] Further, when the target function is a lock function, updating the original data dependency graph based on the target function to obtain a target data dependency graph includes: Determining an acquisition statement and a release statement of the target function from the intermediate language code, and creating a code protection interval between the acquisition statement and the release statement; A second variable involved in the code protection interval is determined, and a protection mark is added to a node corresponding to the second variable in the original data dependency graph to obtain the target data dependency graph.

[0009] Furthermore, traversing each node in the target data dependency graph to determine a target node with a vulnerability from a plurality of nodes in the target data dependency graph includes: For each node in the target data dependency graph, determine whether the node has at least two branches; If there are at least two branches, determine whether the node does not have the protection mark; If the protection mark does not exist, the node is determined as the target node with a vulnerability.

[0010] Furthermore, the target variable corresponding to the target node is subjected to conditional competition vulnerability detection and use-after-release vulnerability detection to obtain a vulnerability detection result of the code to be detected: For each target node, determine whether a target variable corresponding to the target node has at least one write operation in the code to be detected; If there is at least one write operation, it is determined that a conditional competition vulnerability exists in the code function where the target variable is located; If there is no at least one write operation, determining whether the target variable has at least one release operation in the code to be detected; If there is at least one release operation, it is determined that a use-after-free vulnerability exists in the code function where the target variable is located.

[0011] Furthermore, the constructing of the original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code includes: Determine the variables referenced in the intermediate language code and the data flow relationship between each variable; wherein the variables include local variables, global variables, parameters and return values; For each variable, create a node corresponding to the variable in the original image; Based on the data flow relationship, a next variable having a relationship with the variable is determined, and an edge between a node corresponding to the variable and a node corresponding to the next variable is drawn in the original image to obtain the original data dependency graph.

[0012] In a second aspect, an embodiment of the present application further provides a device for detecting a code vulnerability, the device comprising: A code acquisition module is used to acquire the code to be detected, disassemble the code to be detected, and obtain an intermediate language code; A data dependency graph construction module, used to construct an original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code; A data dependency graph update module, used to traverse the intermediate language code, determine the target function called in the intermediate language code, and update the original data dependency graph based on the target function to obtain a target data dependency graph; wherein the target function is a timing creation function and a lock function; A target node determination module, used to traverse each node in the target data dependency graph to determine a target node with a vulnerability from a plurality of nodes in the target data dependency graph; The vulnerability detection module is used to perform conditional competition vulnerability detection and post-release vulnerability detection on the target variable corresponding to the target node to obtain the vulnerability detection result of the code to be detected.

[0013] Further, when the objective function is a time series creation function, when the data dependency graph updating module is used to update the original data dependency graph based on the objective function to obtain a target data dependency graph, the data dependency graph updating module is also used to: Determining a first variable involved in the objective function from the intermediate language code; A branch is created on the node corresponding to the first variable in the original data dependency graph to obtain the target data dependency graph.

[0014] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the code vulnerability detection method as described above are performed.

[0015] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is run by a processor, the steps of the method for detecting code vulnerabilities as described above are executed.

[0016] The embodiments of the present application provide a method, a detection device, a equipment and a medium for detecting code vulnerabilities. First, a code to be detected is obtained, and the code to be detected is disassembled to obtain an intermediate language code; an original data dependency graph corresponding to the code to be detected is constructed based on the data flow relationship between the variables referenced in the intermediate language code; the intermediate language code is traversed to determine the target function called in the intermediate language code, and the original data dependency graph is updated based on the target function to obtain a target data dependency graph; wherein the target function is a timing creation function and a lock function; each node in the target data dependency graph is traversed to determine a target node with a vulnerability from multiple nodes in the target data dependency graph; a conditional competition vulnerability detection and a post-release use vulnerability detection are performed on the target variable corresponding to the target node to obtain a vulnerability detection result of the code to be detected.

[0017] According to the detection method provided by the present application, the data dependency relationship under different timings is represented by a data dependency graph. On the basis of the traditional symbolic execution and taint propagation analysis methods, the program timing analysis technology is introduced. While maintaining the advantages of symbolic execution and taint propagation technology such as fastness and accuracy, the vulnerability problems of use after release and conditional competition in the code are effectively detected through the analysis of program timing analysis and synchronization lock protection. By traversing the data dependency graph, conditional competition vulnerability detection and use after release vulnerability detection are performed, the purpose of effectively discovering security defects in application software and embedded device firmware is achieved, and the accuracy and efficiency of code vulnerability detection are improved.

[0018] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A flowchart of a method for detecting a code vulnerability provided by an embodiment of the present application; Figure 2 A schematic diagram of the effect of a target data dependency graph provided in an embodiment of the present application; Figure 3 A schematic diagram of a code protection zone provided in an embodiment of the present application; Figure 4 A flowchart of a code vulnerability detection method provided by an embodiment of the present application; Figure 5 A schematic diagram of the structure of a code vulnerability detection device provided in an embodiment of the present application; Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0022] First, the application scenarios to which the present application is applicable are introduced. The present application can be applied in the field of computer technology.

[0023] At present, application software and IoT devices have become an indispensable part of daily life, including in work scenarios. As more and more embedded devices are connected to the Internet, user convenience has been significantly improved, but also faces severe security challenges.

[0024] The operating system of an embedded device usually relies on a type of software called "firmware" to run. Firmware can be considered as "built-in software" and refers to software programs that are programmed into a programmable read-only memory (such as Flash). Because firmware code usually enjoys high execution permissions, potential defects or vulnerabilities within it are often difficult to detect.

[0025] Research has found that, for example, failure to fully consider buffer boundaries or insufficient validation of input parameters can be addressed through program static analysis techniques (such as taint analysis). However, for vulnerabilities caused by program protocol interaction or function call timing, existing static taint analysis techniques do not fully consider the relevance of function call contexts under different execution timings, making these vulnerabilities difficult to accurately identify.

[0026] Based on this, an embodiment of the present application provides a method for detecting code vulnerabilities, which can effectively detect the vulnerability problems of use after free and conditional competition in the code, thereby improving the accuracy and efficiency of code vulnerability detection.

[0027] See also Figure 1 , Figure 1 The following is a flow chart of a method for detecting code vulnerabilities provided in an embodiment of the present application. Figure 1 As shown in, the detection method provided in the embodiment of the present application includes: S101, obtaining a code to be detected, and disassembling the code to be detected to obtain an intermediate language code.

[0028] Here, the code to be tested refers to the binary program.

[0029] For the above step S101, in the specific implementation, first obtain the code to be detected, and then disassemble the code to be detected to obtain the intermediate language code. Specifically, use the static analysis tool to load the binary program, identify the instruction set and architecture of the acquired binary program, perform the disassembly operation on it, and then convert the obtained assembly code into the intermediate language P-Code representation. Here, the main role of P-Code is to simplify the reverse engineering process, avoid directly operating different assembly instruction sets of different processors, and by analyzing P-Code, the control flow and data flow of the code can be better understood.

[0030] S102: construct an original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code.

[0031] It should be noted that the data dependency graph is a core data structure in static analysis, which is used to track the definition, use, and propagation relationship of variables or memory areas in different code paths.

[0032] With respect to the above-mentioned step S102, in the specific implementation, after the intermediate language code is obtained in step S101, the original data dependency graph corresponding to the code to be detected is constructed based on the data flow relationship between the variables referenced in the intermediate language code. Specifically, the nodes contained in the original data dependency graph represent the variables in the code to be detected, and the edges between the nodes contained in the original data dependency graph represent the dependency relationship of the variables. According to the embodiment provided by the present application, the intermediate language code is simulated and executed to determine the data flow relationship between the variables referenced by the intermediate language code, and the nodes and edges of the data dependency graph are established accordingly.

[0033] As an optional embodiment, with respect to the above step S102, constructing the original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code includes: Step 1021, determining the variables referenced in the intermediate language code and the data flow relationship between each variable.

[0034] Specifically, the variables include local variables, global variables, parameters and return values.

[0035] For the above step 1021, in the specific implementation, first analyze each instruction in the intermediate language code one by one, determine the local variables created inside the function and the referenced global variables, and list all variables, including local variables, global variables, parameters and return values. Then analyze the data flow between each variable, specifically, identify the situation where the value of a variable is directly used to calculate the value of another variable, identify the impact of a write operation on a subsequent read operation, and the competition condition of two write operations on the same resource, so as to determine the data flow relationship between each variable.

[0036] Step 1022: for each variable, create a node corresponding to the variable in the original image.

[0037] Here, the original image refers to the blank image used to draw the data dependency graph.

[0038] Regarding the above step 1022, during specific implementation, for each determined variable, a node is created for the variable in the original image.

[0039] Step 1023, based on the data flow relationship, determine the next variable that has a relationship with the variable, and draw the edge between the node corresponding to the variable and the node corresponding to the next variable in the original image to obtain the original data dependency graph.

[0040] For the above step 1023, in the specific implementation, based on the data flow relationship determined in step 1021, the next variable that has a relationship with the variable is determined, and the edge between the node corresponding to the variable and the node corresponding to the next variable is drawn in the original image. Here, an edge is drawn from the node corresponding to the variable to the node corresponding to the next variable to obtain the original data dependency graph.

[0041] Furthermore, after obtaining the original data dependency graph, in order to simplify the original data dependency graph and improve subsequent analysis efficiency and readability, the nodes in the original data dependency graph may be simplified and merged to improve the simplicity of the original data dependency graph.

[0042] S103, traversing the intermediate language code, determining the target function called in the intermediate language code, and updating the original data dependency graph based on the target function to obtain a target data dependency graph.

[0043] Here, according to the embodiment provided by the present application, the target function is a timing creation function and a lock function.

[0044] Regarding the above step S103, in specific implementation, each instruction in the intermediate language code is traversed to determine the target function called in the intermediate language code, and the original data dependency graph is updated based on the determined target function to obtain the target data dependency graph.

[0045] As an optional embodiment, with respect to the above step S103, when the objective function is a time series creation function, updating the original data dependency graph based on the objective function to obtain a target data dependency graph includes: A: Determine a first variable involved in the objective function from the intermediate language code.

[0046] B: Create a branch on the node corresponding to the first variable in the original data dependency graph to obtain the target data dependency graph.

[0047] For details, please refer to Table 1 below, which is a schematic diagram of a common timing creation function provided in an embodiment of the present application.

[0048] Table 1 Common time series creation functions

[0049] Here, the functions that generate new call contexts in the intermediate language code are determined, as shown in Table 1 above, such as multithreading, function reentry, asynchronous call and other related API functions, which are called timing creation functions in this application. During the static analysis of the program, as long as the call of such functions is identified, it is considered that a new call context is created.

[0050] Specifically, the intermediate language code is traversed, and each time a sequence creation function is called, a new call context is created, and each call context is independent of each other. Regarding the above steps A-B, when the target function is a sequence creation function, the first variable involved in the target function is determined from the intermediate language code. Then, a branch is created on the node corresponding to the first variable in the original data dependency graph to update the original data dependency graph and obtain the target data dependency graph. Please refer to Figure 2 , Figure 2 This is a schematic diagram of the effect of a target data dependency graph provided by an embodiment of the present application. Figure 2 As shown, the timing creation functions fork and pthread_create are called in the intermediate language code, and the variables corresponding to the node func2 and the variables corresponding to the node func3 both belong to the timing creation function. Therefore, a branch corresponding to the function fork is created on the node func2, and a branch corresponding to the function pthread_create is created on the node func3.

[0051] As an optional embodiment, with respect to the above step S103, when the target function is a lock function, updating the original data dependency graph based on the target function to obtain a target data dependency graph includes: I: determining an acquisition statement and a release statement of the target function from the intermediate language code, and creating a code protection interval between the acquisition statement and the release statement.

[0052] Here, the intermediate language code is traversed, and the lock functions such as synchronization locks, barriers, critical sections, etc. used in the intermediate language code need to be determined. Each acquisition and release of a lock function is called to create a set of code protection intervals. Please refer to Table 2 below, which is a schematic table of a common lock function provided in an embodiment of the present application.

[0053] Table 2 Common lock functions

[0054] Regarding the above step I, in a specific implementation, when the target function is a lock function, the acquisition statement and the release statement of the target function are determined from the intermediate language code, and a code protection interval is created between the acquisition statement and the release statement.

[0055] See also Figure 3 , Figure 3 A schematic diagram of a code protection zone provided in an embodiment of the present application. Figure 3As shown, the target function pthread_mutex_lock in the intermediate language code forms a protection for the variables in the scope between calling the acquisition statement pthread_mutex_lock and the release statement pthread_mutex_unlock function. Therefore, a code protection interval is created between the acquisition statement pthread_mutex_lock and the release statement pthread_mutex_unlock, that is, Figure 3 The rectangular area in .

[0056] II: Determine a second variable involved in the code protection interval, and add a protection mark to a node corresponding to the second variable in the original data dependency graph to obtain the target data dependency graph.

[0057] Regarding the above step II, in the specific implementation, after the code protection interval is created, it is necessary to mark the variables in the code protection interval for protection. First, determine the second variable involved in the code protection interval, and add a protection mark to the node corresponding to the second variable in the original data dependency graph to update the original data dependency graph and obtain the target data dependency graph.

[0058] S104, traversing each node in the target data dependency graph to determine a target node with a vulnerability from a plurality of nodes in the target data dependency graph.

[0059] Regarding the above step S104, in a specific implementation, each node in the updated target data dependency graph is traversed to determine the target node with a vulnerability from the multiple nodes in the target data dependency graph.

[0060] Specifically, with respect to the above step S104, traversing each node in the target data dependency graph to determine a target node with a vulnerability from a plurality of nodes in the target data dependency graph includes: Step 1041, for each node in the target data dependency graph, determine whether the node has at least two branches.

[0061] Step 1042: If there are at least two branches, determine whether the node does not have the protection mark.

[0062] Step 1043: If the protection mark does not exist, the node is determined as the target node with a vulnerability.

[0063] Specifically, the target data dependency graph is used to analyze the nodes referenced in each call context to find out whether there are nodes that are in multiple contexts and are not marked as protected at the same time. Such nodes are considered to be target nodes with vulnerabilities.

[0064] For the above steps 1041 to 1043, in the specific implementation, for each node in the target data dependency graph, it is determined whether the node has at least two branches. If the node has at least two branches, it is determined whether the node does not have a protection mark. If the node does not have a protection mark, the node is determined as a target node with a vulnerability.

[0065] S105, performing conditional competition vulnerability detection and use-after-free vulnerability detection on the target variable corresponding to the target node to obtain a vulnerability detection result of the code to be detected.

[0066] Regarding the above step S105, in specific implementation, after determining the target node with a vulnerability, a conditional competition vulnerability detection and a use-after-free vulnerability detection are performed on the target variable corresponding to the target node to obtain a vulnerability detection result of the code to be detected.

[0067] As an optional embodiment, for the above step S105, the target variable corresponding to the target node is subjected to conditional competition vulnerability detection and use-after-free vulnerability detection to obtain a vulnerability detection result of the code to be detected: Step 1051: for each target node, determine whether a target variable corresponding to the target node has at least one write operation in the code to be detected.

[0068] Step 1052: If there is at least one write operation, it is determined that a conditional race vulnerability exists in the code function where the target variable is located.

[0069] In the specific implementation of the above steps 1051-1052, a conditional competition vulnerability detection is performed on the target variable corresponding to the target node that is referenced by at least two different call contexts and has not obtained a protection mark, and it is determined whether the target variable has at least one write operation in the code to be detected. If there is at least one write operation, it indicates that there is a conditional competition vulnerability in the code function where the target variable is located.

[0070] Step 1053: If there is no at least one write operation, determine whether there is at least one release operation for the target variable in the code to be detected.

[0071] Step 1054: If there is at least one release operation, it is determined that the code function where the target variable is located has a use-after-free vulnerability.

[0072] For the above steps 1053-1054, in the specific implementation, if the target variable does not have at least one write operation, then continue to perform a use-after-free vulnerability detection on the target variable to determine whether the target variable has at least one release operation in the code to be detected. If there is at least one release operation, it indicates that the code function where the target variable is located has a use-after-free vulnerability.

[0073] See also Figure 4 , Figure 4 The following is a flow chart of a code vulnerability detection method provided by an embodiment of the present application. Figure 4 As shown, firstly, the code to be detected is disassembled, the code to be detected is converted into the intermediate language code P-Code form, the execution is simulated, and the data dependency graph is constructed. Then the function that creates a new call context in the program is determined, that is, the sequence creation function; the lock function used in the program is determined. The intermediate language code is traversed, the call context created by the program is analyzed, and the code protection interval created by the program is analyzed. The call context is traversed to determine whether there are variables in multiple call contexts, and the variable read and write properties are determined. First, it is determined whether the variable is in multiple contexts, that is, whether there are multiple branches at the node corresponding to the variable in the data dependency graph. If so, it is continued to determine whether the variable is in the code protection interval, that is, whether there is a protection mark at the node corresponding to the variable in the data dependency graph. If not, the node is determined to be a node with a vulnerability. When the variable has at least one write operation, it indicates that the function has a conditional competition vulnerability. If the variable has at least one release operation, it indicates that the function has a use-after-release vulnerability.

[0074] The code vulnerability detection method provided in the embodiment of the present application comprises the following steps: first, obtaining the code to be detected, disassembling the code to be detected, and obtaining an intermediate language code; constructing an original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code; traversing the intermediate language code, determining the target function called in the intermediate language code, and updating the original data dependency graph based on the target function to obtain a target data dependency graph; wherein the target function is a timing creation function and a lock function; traversing each node in the target data dependency graph to determine a target node with a vulnerability from multiple nodes in the target data dependency graph; and performing conditional competition vulnerability detection and use-after-release vulnerability detection on the target variable corresponding to the target node to obtain a vulnerability detection result of the code to be detected.

[0075] The detection method provided in the embodiment of the present application first disassembles the code to be detected that needs to be analyzed and detected, and converts it into an intermediate language code representation; then builds a data dependency graph; then determines the timing creation function and lock function in the program, as well as the functions such as synchronization locks, barriers, critical sections, etc. used in the program; then traverses the intermediate language code to perform conditional competition vulnerability detection and post-release use vulnerability detection to detect possible program vulnerabilities.

[0076] Thus, according to the detection method provided by the present application, the data dependency relationship under different timings is represented by a data dependency graph, and the program timing analysis technology is introduced on the basis of the traditional symbolic execution and taint propagation analysis methods. While maintaining the advantages of symbolic execution and taint propagation technology such as fastness and accuracy, the vulnerability problems of use after release and conditional competition in the code are effectively detected through the analysis of program timing analysis and synchronization lock protection. By traversing the data dependency graph, conditional competition vulnerability detection and use after release vulnerability detection are performed, the purpose of effectively discovering security defects in application software and embedded device firmware is achieved, and the accuracy and efficiency of code vulnerability detection are improved.

[0077] See also Figure 5 , Figure 5 This is a schematic diagram of the structure of a code vulnerability detection device provided in an embodiment of the present application. Figure 5 As shown in , the detection device 500 includes: The code acquisition module 501 is used to acquire the code to be detected, and disassemble the code to be detected to obtain the intermediate language code; A data dependency graph construction module 502 is used to construct an original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code; A data dependency graph updating module 503 is used to traverse the intermediate language code, determine the target function called in the intermediate language code, and update the original data dependency graph based on the target function to obtain a target data dependency graph; wherein the target function is a timing creation function and a lock function; A target node determination module 504 is used to traverse each node in the target data dependency graph to determine a target node with a vulnerability from a plurality of nodes in the target data dependency graph; The vulnerability detection module 505 is used to perform conditional competition vulnerability detection and use-after-free vulnerability detection on the target variable corresponding to the target node to obtain the vulnerability detection result of the code to be detected.

[0078] Further, when the objective function is a time series creation function, the data dependency graph updating module 503 is used to update the original data dependency graph based on the objective function to obtain a target data dependency graph, and the data dependency graph updating module 503 is also used to: Determining a first variable involved in the objective function from the intermediate language code; A branch is created on the node corresponding to the first variable in the original data dependency graph to obtain the target data dependency graph.

[0079] Further, when the target function is a lock function, the data dependency graph updating module 503 is used to update the original data dependency graph based on the target function to obtain the target data dependency graph, and the data dependency graph updating module 503 is also used to: Determining an acquisition statement and a release statement of the target function from the intermediate language code, and creating a code protection interval between the acquisition statement and the release statement; A second variable involved in the code protection interval is determined, and a protection mark is added to a node corresponding to the second variable in the original data dependency graph to obtain the target data dependency graph.

[0080] Further, when the target node determination module 504 is used to traverse each node in the target data dependency graph to determine a target node with a vulnerability from multiple nodes in the target data dependency graph, the target node determination module 504 is also used to: For each node in the target data dependency graph, determine whether the node has at least two branches; If there are at least two branches, determine whether the node does not have the protection mark; If the protection mark does not exist, the node is determined as the target node with a vulnerability.

[0081] Further, when the vulnerability detection module 505 is used to perform conditional competition vulnerability detection and post-release use vulnerability detection on the target variable corresponding to the target node to obtain the vulnerability detection result of the code to be detected, the vulnerability detection module 505 is also used to: For each target node, determine whether a target variable corresponding to the target node has at least one write operation in the code to be detected; If there is at least one write operation, it is determined that a conditional competition vulnerability exists in the code function where the target variable is located; If there is no at least one write operation, determining whether the target variable has at least one release operation in the code to be detected; If there is at least one release operation, it is determined that a use-after-free vulnerability exists in the code function where the target variable is located.

[0082] Furthermore, when the data dependency graph construction module 502 is used to construct the original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code, the data dependency graph construction module 502 is also used to: Determine the variables referenced in the intermediate language code and the data flow relationship between each variable; wherein the variables include local variables, global variables, parameters and return values; For each variable, create a node corresponding to the variable in the original image; Based on the data flow relationship, a next variable having a relationship with the variable is determined, and an edge between a node corresponding to the variable and a node corresponding to the next variable is drawn in the original image to obtain the original data dependency graph.

[0083] See also Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 6 As shown in , the electronic device 600 includes a processor 610 , a memory 620 and a bus 630 .

[0084] The memory 620 stores machine-readable instructions executable by the processor 610. When the electronic device 600 is running, the processor 610 communicates with the memory 620 via the bus 630. When the machine-readable instructions are executed by the processor 610, the above-mentioned Figure 1 The steps of the method for detecting code vulnerabilities in the method embodiment shown, and the specific implementation method can be found in the method embodiment, which will not be repeated here.

[0085] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 The steps of the method for detecting code vulnerabilities in the method embodiment shown, and the specific implementation method can be found in the method embodiment, which will not be repeated here.

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0087] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0088] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0089] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0090] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0091] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting code vulnerabilities, characterized in that: The detection method comprises: Obtaining the code to be detected, and disassembling the code to be detected to obtain an intermediate language code; Constructing an original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code; Traversing the intermediate language code, determining the target function called in the intermediate language code, and updating the original data dependency graph based on the target function to obtain a target data dependency graph; wherein the target function is a timing creation function and a lock function; Traversing each node in the target data dependency graph to determine a target node with a vulnerability from a plurality of nodes in the target data dependency graph; A conditional competition vulnerability detection and a use-after-free vulnerability detection are performed on the target variable corresponding to the target node to obtain a vulnerability detection result of the code to be detected.

2. The detection method according to claim 1, characterized in that: When the objective function is a time series creation function, the updating of the original data dependency graph based on the objective function to obtain a target data dependency graph includes: Determining a first variable involved in the objective function from the intermediate language code; A branch is created on the node corresponding to the first variable in the original data dependency graph to obtain the target data dependency graph.

3. The detection method according to claim 2, characterized in that: When the objective function is a lock function, updating the original data dependency graph based on the objective function to obtain a target data dependency graph includes: Determining an acquisition statement and a release statement of the target function from the intermediate language code, and creating a code protection interval between the acquisition statement and the release statement; A second variable involved in the code protection interval is determined, and a protection mark is added to a node corresponding to the second variable in the original data dependency graph to obtain the target data dependency graph.

4. The detection method according to claim 3, characterized in that: The traversing each node in the target data dependency graph to determine a target node with a vulnerability from a plurality of nodes in the target data dependency graph includes: For each node in the target data dependency graph, determine whether the node has at least two branches; If there are at least two branches, determine whether the node does not have the protection mark; If the protection mark does not exist, the node is determined as the target node with a vulnerability.

5. The detection method according to claim 1, characterized in that: The target variable corresponding to the target node is subjected to conditional competition vulnerability detection and use-after-release vulnerability detection to obtain a vulnerability detection result of the code to be detected: For each target node, determine whether a target variable corresponding to the target node has at least one write operation in the code to be detected; If there is at least one write operation, it is determined that a conditional competition vulnerability exists in the code function where the target variable is located; If there is no at least one write operation, determining whether the target variable has at least one release operation in the code to be detected; If there is at least one release operation, it is determined that a use-after-free vulnerability exists in the code function where the target variable is located.

6. The detection method according to claim 1, characterized in that: The step of constructing the original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code includes: Determine the variables referenced in the intermediate language code and the data flow relationship between each variable; wherein the variables include local variables, global variables, parameters and return values; For each variable, create a node corresponding to the variable in the original image; Based on the data flow relationship, a next variable having a relationship with the variable is determined, and an edge between a node corresponding to the variable and a node corresponding to the next variable is drawn in the original image to obtain the original data dependency graph.

7. A device for detecting code vulnerabilities, characterized in that: The detection device comprises: A code acquisition module is used to acquire the code to be detected, disassemble the code to be detected, and obtain an intermediate language code; A data dependency graph construction module, used to construct an original data dependency graph corresponding to the code to be detected based on the data flow relationship between the variables referenced in the intermediate language code; A data dependency graph update module, used to traverse the intermediate language code, determine the target function called in the intermediate language code, and update the original data dependency graph based on the target function to obtain a target data dependency graph; wherein the target function is a timing creation function and a lock function; A target node determination module, used to traverse each node in the target data dependency graph to determine a target node with a vulnerability from a plurality of nodes in the target data dependency graph; The vulnerability detection module is used to perform conditional competition vulnerability detection and post-release vulnerability detection on the target variable corresponding to the target node to obtain the vulnerability detection result of the code to be detected.

8. The detection device according to claim 7, characterized in that: When the objective function is a time series creation function, the data dependency graph updating module is used to update the original data dependency graph based on the objective function to obtain a target data dependency graph, and the data dependency graph updating module is further used to: Determining a first variable involved in the objective function from the intermediate language code; A branch is created on the node corresponding to the first variable in the original data dependency graph to obtain the target data dependency graph.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to perform the steps of the code vulnerability detection method as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for detecting code vulnerabilities according to any one of claims 1 to 6 are executed.

Images