Kernel suspected vulnerability sample analysis method and device, electronic equipment and storage medium

Abstract

The application provides a kernel suspected vulnerability sample analysis method and device, electronic equipment and a storage medium, wherein the method comprises: acquiring a plurality of information point data included in a sample file of a kernel suspected vulnerability; determining whether the sample file satisfies a preset integrity condition according to the plurality of information point data; in the case where the sample file satisfies the preset integrity condition, determining analyzability information of the kernel suspected vulnerability, and determining exploitability information of the kernel suspected vulnerability, the analyzability information comprising an analyzability score, the exploitability information comprising an exploitability score, the higher the exploitability score, the greater the possibility of vulnerability exploitation; and generating an analysis report of the sample file based on the analyzability information and the exploitability information. The embodiments provided by the application can improve the analysis efficiency of the kernel suspected vulnerability, thereby improving the efficiency of vulnerability mining.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vulnerability mining, and in particular to a kernel suspected vulnerability sample analysis method and device, an electronic device, and a storage medium. BACKGROUND

[0002] At present, there are mature fuzz testing tools in the field of Linux kernel vulnerability mining. The tools can perform fuzz testing on different versions of the kernel to attempt to discover potential vulnerabilities in the kernel. However, in related technologies, suspected problems discovered by the fuzz testing tool need to be manually analyzed by experienced experts. The experts first need to analyze whether the relevant information provided by the tool is complete. If important information is missing, the problem may not be effectively analyzed. When the relevant information is relatively complete, the expert can perform root cause analysis to determine the problem occurrence point, occurrence condition, and adverse effects, and determine whether the problem is a vulnerability. Since the Linux mainline maintains multiple different versions of the kernel, the kernel code is large and continuously evolving, and the tool may discover a large number of suspected vulnerabilities. How to efficiently discover serious vulnerabilities from a large number of suspected problems is a challenge that needs to be solved. SUMMARY

[0003] The present application provides a kernel suspected vulnerability sample analysis method, device, electronic device, and storage medium, which can improve the analysis efficiency of suspected vulnerability samples and thus improve the efficiency of vulnerability mining. The above technical solution is as follows:

[0004] In a first aspect, the present application provides a kernel suspected vulnerability sample analysis method, which includes:

[0005] Obtaining a plurality of information point data included in a kernel suspected vulnerability sample file, the sample file including abnormal information captured in fuzz testing;

[0006] Determining whether the sample file satisfies a preset completeness condition according to the plurality of information point data;

[0007] In the case where the sample file satisfies the preset completeness condition, determining analyzability information of the kernel suspected vulnerability and exploitability information of the kernel suspected vulnerability, the analyzability information including an analyzability score, and the exploitability information including an exploitability score;

[0008] Generating an analysis report of the sample file based on the analyzability information and the exploitability information.

[0009] In a possible implementation, the obtaining of the plurality of information point data included in the kernel suspected vulnerability sample file includes:

[0010] Determining a file type corresponding to the kernel suspected vulnerability sample file;

[0011] determining a target analysis plug-in corresponding to the sample file according to the file type;

[0012] analyzing the sample file through the target analysis plug-in to obtain a plurality of information point data included in the kernel suspected vulnerability sample file.

[0013] In a possible implementation, the determining whether the sample file meets a preset integrity condition according to the plurality of information point data includes:

[0014] determining whether the plurality of information point data contains at least one preset information point data set;

[0015] in a case where the plurality of information point data contains at least one preset information point data set, determining that the plurality of information point data meets the preset integrity condition;

[0016] in a case where the plurality of information point data does not contain any preset information point data set, determining that the plurality of information point data does not meet the preset integrity condition.

[0017] In a possible implementation, the determining the analyzability information of the kernel suspected vulnerability includes:

[0018] obtaining a first preset score corresponding to each first information point data in the plurality of information point data, and an information value corresponding to second information point data, the second information point data being used to indicate a number of times of reproduction;

[0019] calculating a sum of the first preset scores corresponding to each first information point data;

[0020] determining a product of the sum of the first preset scores and the information value as an analyzability score of the kernel suspected vulnerability.

[0021] In a possible implementation, the analyzability information further includes an analyzability level, and the determining the analyzability information of the kernel suspected vulnerability includes:

[0022] obtaining a plurality of score intervals corresponding to a plurality of reference levels;

[0023] determining a target score interval to which the analyzability score belongs;

[0024] determining a reference level corresponding to the target score interval as the analyzability level of the kernel suspected vulnerability.

[0025] In a possible implementation, the determining the exploitability information of the kernel suspected vulnerability includes:

[0026] determine a problem type and key element information of each information point data in the plurality of information point data;

[0027] determine the exploitability score of the kernel suspected vulnerability based on the problem type and the key element information of each information point data.

[0028] In a possible implementation, the determining the exploitability score of the kernel suspected vulnerability based on the problem type and the key element information of each information point data includes:

[0029] for each information point data, obtaining a scoring rule corresponding to the information point data according to the problem type of the information point data;

[0030] determining a second preset score corresponding to the information point data according to the key element information of the information point data and the scoring rule;

[0031] adding the second preset scores corresponding to each information point data to obtain the exploitability score of the kernel suspected vulnerability.

[0032] In a second aspect, an embodiment of the present application provides a kernel suspected vulnerability sample analysis device, and the device includes:

[0033] an obtaining module, configured to obtain a plurality of information point data included in a kernel suspected vulnerability sample file, and the sample file includes abnormal information captured in fuzz testing;

[0034] a first determining module, configured to determine whether the sample file meets a preset integrity condition according to the plurality of information point data;

[0035] a second determining module, configured to, in a case where the sample file meets the preset integrity condition, determine analyzability information of the kernel suspected vulnerability and determine exploitability information of the kernel suspected vulnerability, the analyzability information including an analyzability score, and the exploitability information including an exploitability score;

[0036] a generating module, configured to generate an analysis report of the sample file based on the analyzability information and the exploitability information.

[0037] In a possible implementation, the obtaining module includes:

[0038] a first determining unit, configured to determine a file type corresponding to a kernel suspected vulnerability sample file;

[0039] a second determining unit, configured to determine a target parsing plug-in corresponding to the sample file based on the file type;

[0040] The analysis unit is configured to analyze the sample file by using the target analysis plug-in to obtain a plurality of information point data included in the kernel suspected vulnerability sample file.

[0041] In a possible implementation, the first determination module comprises:

[0042] The first determination module comprises:

[0043] The third determination unit is configured to determine that the plurality of information point data satisfy the preset integrity condition when the plurality of information point data comprise at least one preset information point data set.

[0044] The fourth determination unit is configured to determine that the plurality of information point data do not satisfy the preset integrity condition when the pluralityity of information point data do not comprise any preset information point data set.

[0045] In a possible implementation, the second determination module comprises:

[0046] The first acquisition unit is configured to acquire a first preset score corresponding to each first information point data in the plurality of information point data, and an information value corresponding to second information point data, the second information point data being used to indicate a number of times of reproduction.

[0047] The calculation unit is configured to calculate a sum of the first preset scores corresponding to each first information point data.

[0048] The fifth determination unit is configured to determine a product of the sum of the first preset scores and the information value as an analyzability score of the kernel suspected vulnerability.

[0049] In a possible implementation, the analyzability information further comprises an analyzability level, and the second determination module comprises:

[0050] The second acquisition unit is configured to acquire a plurality of score intervals corresponding to a plurality of reference levels.

[0051] The sixth determination unit is configured to determine a target score interval to which the analyzability score belongs.

[0052] The seventh determination unit is configured to determine a reference level corresponding to the target score interval as the analyzability level corresponding to the kernel suspected vulnerability.

[0053] In a possible implementation, the second determination module comprises:

[0054] An eighth determining unit is configured to determine a question type and key element information of each information point data in the plurality of information point data.

[0055] A ninth determining unit is configured to determine an exploitability score of each information point data based on the question type and the key element information of each information point data.

[0056] In a possible implementation, the ninth determining unit comprises:

[0057] An obtaining sub-unit is configured to obtain, for each information point data, a scoring rule corresponding to the information point data according to a question type of the information point data;

[0058] A first determining sub-unit is configured to determine a second preset score corresponding to the information point data according to the key element information of the information point data and the scoring rule;

[0059] A second determining sub-unit is configured to determine a sum of the second preset scores corresponding to each information point data as the exploitability score of the kernel suspected vulnerability.

[0060] In a third aspect, an electronic device is provided, comprising a processor and a memory.

[0061] The memory stores a computer program, and the computer program is adapted to be loaded by the processor and execute the steps of the method provided in the first aspect or any possible implementation of the first aspect.

[0062] In a fourth aspect, a computer storage medium is provided, and the computer storage medium stores a plurality of instructions, and the instructions are adapted to be loaded by a processor and execute the steps of the method provided in the first aspect or any possible implementation of the first aspect.

[0063] The embodiment of the application obtains a plurality of information point data included in a kernel suspected vulnerability sample file, the sample file including exception information captured in fuzz testing; determines whether the sample file satisfies a preset integrity condition according to the plurality of information point data; in the case where the sample file satisfies the preset integrity condition, determines analyzability information of the kernel suspected vulnerability and exploitability information of the kernel suspected vulnerability, the analyzability information including an analyzability score, and the exploitability information including an exploitability score; and generates an analysis report of the sample file based on the analyzability information and the exploitability information. By scoring the analyzability and exploitability of the kernel suspected vulnerability in the case where the sample file satisfies the preset integrity condition, the severity of the vulnerability can be determined by a security expert, the security expert prioritizes analyzing the vulnerability with high analyzability and high exploitability, the efficiency of kernel suspected vulnerability sample analysis is improved, and the vulnerability mining efficiency is further improved. BRIEF DESCRIPTION OF DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0065] Figure 1 A structural schematic diagram of a kernel suspected vulnerability sample analysis system provided for an exemplary embodiment of the present application;

[0066] Figure 2 A flowchart of a kernel suspected vulnerability sample analysis method provided for an exemplary embodiment of the present application;

[0067] Figure 3 A flowchart of a determination method of a target analysis plug-in provided for an exemplary embodiment of the present application;

[0068] Figure 4 A structural schematic diagram of a sample directory topology provided for an exemplary embodiment of the present application;

[0069] Figure 5 A specific flowchart of a kernel suspected vulnerability sample analysis method provided for an exemplary embodiment of the present application;

[0070] Figure 6 A page schematic diagram of a vulnerability analysis report provided for an exemplary embodiment of the present application;

[0071] Figure 7 A structural schematic diagram of a kernel suspected vulnerability sample analysis device provided for an exemplary embodiment of the present application;

[0072] Figure 8 A structural schematic diagram of an electronic device is provided for an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0073] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.

[0074] The terms “first”, “second”, “third”, etc. in the specification and claims of the present application and the above drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms “include” and “have” and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed or can optionally include other steps or units inherent to the process, method, product or device.

[0075] Next, refer to Figure 1 which exemplarily shows a structural schematic diagram of a kernel suspected vulnerability sample analysis system provided by an embodiment of the present application. As shown in Figure 1 , the system includes a terminal device 110 and a server 120, and the terminal device 110 and the server 120 are connected through a network, such as a wired or wireless network connection, etc.

[0076] The terminal device 110 can be used to display a graphical user interface, and the terminal device 110 is used to interact with a user through the graphical user interface, for example, by downloading and installing a corresponding client through the terminal device 110 and running. In the embodiments of the present application, the terminal device 110 can also be used by relevant personnel to upload sample files of kernel suspected vulnerabilities; the terminal device 110 can send multiple sample files of kernel suspected vulnerabilities to the server 120, so that the server 120 determines whether the sample files meet a preset integrity condition; in the case where the sample files meet the preset integrity condition, the analyzability information of the kernel suspected vulnerability is determined, and the exploitability information of the kernel suspected vulnerability is determined, the analyzability information includes an analyzability score, and the exploitability information includes an exploitability score; based on the analyzability information and the exploitability information, an analysis report of the sample files is generated, and the analysis report of the sample files is fed back to the terminal device 110.

[0077] Optionally, the terminal device 110 can also directly determine whether the sample file meets the preset integrity condition according to the sample file of the suspected kernel vulnerability uploaded by the relevant personnel; in the case where the sample file meets the preset integrity condition, the analyzability information of the suspected kernel vulnerability is determined, and the exploitability information of the suspected kernel vulnerability is determined, the analyzability information includes an analyzability score, and the exploitability information includes an exploitability score; based on the analyzability information and the exploitability information, an analysis report of the sample file is generated.

[0078] In some embodiments, the terminal device 110 is configured to perform the following steps: obtaining a plurality of information point data corresponding to a sample file of a fuzz test; determining whether the sample file meets a preset integrity condition according to the plurality of information point data; in the case where the sample file meets the preset integrity condition, determining analyzability information corresponding to each information point data in the plurality of information point data, and determining exploitability information corresponding to each information point data, the analyzability information including an analyzability score, and the exploitability information including an exploitability score; based on the analyzability information corresponding to each information point data and the exploitability information corresponding to each information point data, generating an analysis report of the sample file.

[0079] Optionally, the sample file can include abnormal information captured by a preset fuzz testing tool during fuzz testing. Fuzz testing is a method of discovering software vulnerabilities by providing unexpected input to a target system and monitoring abnormal results. The sample file can represent a suspected vulnerability in the target kernel during fuzz testing. The suspected kernel vulnerability may only be a bug, or it may be a vulnerability with security implications.

[0080] Optionally, the target system can be a Linux kernel operating system. Optionally, the preset integrity condition refers to some specific standards or requirements that the sample file needs to meet before analyzing the suspected kernel vulnerability sample, in order to improve the comprehensiveness and effectiveness of the suspected kernel vulnerability sample analysis. The preset integrity condition can include at least one of the following aspects: data format integrity, information integrity, data consistency, test target coverage, etc.

[0081] Optionally, in the case where the sample file meets the preset integrity condition, the suspected kernel vulnerability is considered to have analyzability, and the exploitability information of the suspected kernel vulnerability can be determined.

[0082] Optionally, the above-mentioned analyzability information and the above-mentioned exploitability information are summarized, and an overall analysis report corresponding to the kernel suspected vulnerability, i.e., an analysis report of the kernel suspected vulnerability sample file, can be obtained. The analysis report includes the analyzability information and the exploitability information of the kernel suspected vulnerability.

[0083] An example embodiment of the present application provides a kernel suspected vulnerability sample analysis method. The kernel suspected vulnerability sample analysis method can be applied to the terminal device described above. For details, please refer to Figure 2 , which exemplarily shows a flowchart of a kernel suspected vulnerability sample analysis method provided by an embodiment of the present application. As shown in Figure 2 , the kernel suspected vulnerability sample analysis method includes the following S21-S24:

[0084] S21, obtaining a plurality of information point data included in a kernel suspected vulnerability sample file, wherein the sample file includes abnormal information captured in fuzz testing.

[0085] In some embodiments, the sample to be analyzed can be problem data output by a preset fuzz testing tool during fuzz testing. The fuzz testing is a method of discovering software vulnerabilities by providing unexpected input to a target system and monitoring abnormal results. The sample can represent a suspected vulnerability of a target kernel during fuzz testing. The kernel suspected vulnerability can be only a bug, or a vulnerability with security impact.

[0086] In some embodiments, the target system can be an operating system of a Linux kernel.

[0087] In some embodiments, the sample file is a sample of a suspected kernel vulnerability, including all context information related to the suspected kernel vulnerability. The sample file can be one or more, and can specifically include at least one of the following file types: a kernel log, a trace log, a tool log, a proof of concept (PoC) source code, a system kernel source code, a vmlinux file, etc. The kernel log can be a log generated by the Linux kernel, used to record messages related to the system kernel, such as driver loading information, kernel warning information, kernel crash information, etc. The trace log is a system call log output by the trace tool, used to record system calls, call parameters, process scheduling, etc. The tool log is a log generated by a specific test tool in fuzz testing, used to record the process and results of the tool during fuzz testing. The PoC source code is a simplified code that demonstrates a vulnerability or attack. The PoC source code can be used to verify whether the target kernel has a vulnerability or whether the kernel crash can be triggered by fuzz testing. The kernel source code is the source code of the kernel being tested (such as the Linux kernel), used to analyze the root cause of the suspected vulnerability. The vmlinux file is a binary image of the kernel being tested, which can be used for crash site analysis.

[0088] In some embodiments, the sample file can include multiple information point data. The multiple information point data provides key information about the target kernel for the sample file. These information point data can be used to analyze the response of the kernel when facing different types of input.

[0089] S22, determining whether the sample file satisfies a preset integrity condition according to the multiple information point data.

[0090] In some embodiments, the preset integrity condition refers to some specific standards or requirements that the sample file needs to satisfy before analyzing the suspected kernel vulnerability sample, in order to improve the comprehensiveness and effectiveness of the analysis of the suspected kernel vulnerability sample. The preset integrity condition can include at least one of the following aspects: data format integrity, information integrity, data consistency, test target coverage, etc.

[0091] S23, determining the analyzability information of the suspected kernel vulnerability and the exploitability information of the suspected kernel vulnerability, wherein the analyzability information includes an analyzability score, and the exploitability information includes an exploitability score, when the sample file satisfies the preset integrity condition.

[0092] In some embodiments, when the sample file satisfies the preset integrity condition, the suspected kernel vulnerability can be considered to have analyzability, and the exploitability information of the suspected kernel vulnerability can be determined.

[0093] The analyzability information indicates whether the suspected vulnerability context information of the kernel is complete and clear enough to help security experts perform root cause analysis. The analyzability score indicates the information quality contained in the sample file and the support degree for subsequent root cause analysis. The analyzability score can objectively reflect the richness of valuable information contained in the sample, and the higher the score, the greater the possibility of root cause analysis of the suspected vulnerability. The exploitability information indicates whether the suspected vulnerability of the kernel can be effectively exploited. The exploitability score indicates the difficulty of writing a vulnerability exploit program. The higher the exploitability score, the greater the possibility of vulnerability exploitation.

[0094] S24, based on the analyzability information and the exploitability information, generating an analysis report of the sample file.

[0095] In some embodiments, the analyzability information and the exploitability information are summarized to obtain an overall analysis report of the suspected vulnerability of the kernel, i.e., an analysis report of the sample file. The analysis report includes the analyzability information and the exploitability information of the suspected vulnerability of the kernel.

[0096] The embodiments of the present application obtain a plurality of information point data included in a sample file of a suspected vulnerability of a kernel, the sample file including abnormal information captured in fuzz testing; determine whether the sample file meets a preset integrity condition according to the plurality of information point data; in the case that the sample file meets the preset integrity condition, determine analyzability information of the suspected vulnerability of the kernel, and determine exploitability information of the suspected vulnerability of the kernel, the analyzability information including an analyzability score, and the exploitability information including an exploitability score; based on the analyzability information and the exploitability information, generate an analysis report of the sample file. By scoring the analyzability and exploitability of the suspected vulnerability of the kernel in the case that the sample file meets the preset integrity condition, the severity of the vulnerability can be determined by security experts, security experts prefer to analyze vulnerabilities with high analyzability and high exploitability, thereby improving the efficiency of vulnerability mining.

[0097] In some embodiments, in S21, the plurality of information point data included in the sample file of the suspected vulnerability of the kernel includes S211-S213:

[0098] S211, determining a file type corresponding to the sample file of the suspected vulnerability of the kernel.

[0099] In some embodiments, the file type of the sample file is at least one of the following: a kernel log, a trace log, a tool log, a PoC source code, a system kernel source code, and a vmlinux file.

[0100] In some embodiments, in S211, the file type corresponding to the kernel suspected vulnerability sample file can be determined by the directory topology feature of the sample file, and sample files of various file types are different from each other. The directory topology feature refers to the organization structure of the file in the file system.

[0101] Specifically, the generated sample file has a fixed directory and file organization structure. By analyzing the directory structure of the sample file, the source of the file and the corresponding file type can be determined.

[0102] S212, determining the target analysis plug-in corresponding to the sample file based on the file type.

[0103] In some embodiments, in S212, the target analysis plug-in corresponding to the sample file is determined based on the file type, including: taking the preset analysis plug-in corresponding to the file type as the target analysis plug-in corresponding to the sample file.

[0104] The preset analysis plug-in can include standardized analysis plug-ins and custom analysis plug-ins, and the custom analysis plug-in can be one or more. Optionally, the preset analysis plug-in corresponding to the trace log, the kernel log, the kernel source code and the vmlinux file is a standardized analysis plug-in. The tool log and the PoC source code are generated by the fuzzing tool and have different formats, and the corresponding preset analysis plug-in can be a custom analysis plug-in.

[0105] In addition, the target analysis plug-in can also fill in the directory path of the sample file and mark which fuzzing tool is used.

[0106] Figure 3 A flowchart of a method for determining a target analysis plug-in is provided for an exemplary embodiment of the present application, as shown in Figure 3 The method for determining a target analysis plug-in includes S301-S305:

[0107] S301, determining the file type corresponding to the sample file.

[0108] Optionally, the specific steps of S301 are consistent with the above S211, which will not be described here.

[0109] S302, determining whether the file type has a fixed standardized analysis plug-in, if yes, performing S303, if not, performing S304.

[0110] Optionally, whether the file type has a fixed standardized analysis plug-in can be determined by consulting official documents or standards.

[0111] S303, determining the fixed standardized analysis plug-in as the preset analysis plug-in.

[0112] S304, from the definition analysis plug-in, obtain the preset analysis plug-in corresponding to the file type.

[0113] S305, the preset analysis plug-in is used as the target analysis plug-in corresponding to the sample file.

[0114] That is, if the file type has a fixed standardized analysis plug-in, it is directly used as the preset analysis plug-in. By using the existing analysis plug-in, time and resources can be saved. If there is no fixed standardized analysis plug-in, it is necessary to develop or customize the analysis plug-in according to the file type, for example, a new analysis code can be written, or the analysis plug-in of a similar file type is modified and adapted, through the self-defined analysis plug-in, the analysis requirement of the special file type is met, and the file content can be correctly analyzed.

[0115] S213, through the above target analysis plug-in, the sample file is analyzed to obtain a plurality of information point data included in the sample file of the kernel suspected vulnerability.

[0116] Through the target analysis plug-in, the content of the sample file is analyzed into specific information point data, and the analysis result is output, and the analysis result includes a plurality of information point data.

[0117] In some embodiments, the information point data corresponding to the sample file of the kernel log type includes: problem type, crash location, function at crash location, central processing unit (CPU) number, process identifier (PID), process name, call stack backtracking, program counter value, crash location instruction code, general register value, value saved on the stack, out-of-bound access type, out-of-bound access length, out-of-bound access memory type, out-of-bound access heap size, out-of-bound access offset, memory allocation and release CPU number, memory allocation and release process PID, memory allocation and release path, and related memory state record. Among them, the problem type and the CPU number are used to assist in determining the problem type; the function at the crash location, the program counter value, the crash location instruction code and the general register value are used to assist in locating the problem; the process PID and the process name are used to assist in locating the problem and determining the problem type; the call stack backtracking and the value saved on the stack are used to assist in analyzing the problem logic; the out-of-bound access type, the out-of-bound access length, the out-of-bound access memory type, the out-of-bound access heap size, the out-of-bound access offset, the memory allocation and release CPU number, the memory allocation and release process PID, the memory allocation and release path, and the related memory state record are used to assist in determining the problem type and evaluating the exploitability.

[0118] In some embodiments, the information point data corresponding to the sample file of the trace log type includes: system call sequence and parameters, which are used to assist in locating the problem, analyzing the problem logic, and evaluating the exploitability.

[0119] In some embodiments, the information point data corresponding to the sample file of the tool log type includes: system call sequence and parameters, which are used to assist in locating the problem, analyzing the problem logic, and evaluating the exploitability; and can also include the number of reproductions, which can be used to comprehensively evaluate the analyzability of the problem reflected by the information point data from two aspects: first, the difficulty of problem reproduction, if the problem can be reproduced, it means that the fuzzing tool captures multiple sample files, and the sample files provide basic information point data, and the tool can determine that different sample files reflect the same problem; second, when the same information point data is reproduced multiple times, different sample files record the relevant context information at each problem reproduction, and relevant experts can cross-analyze these sample files to more easily determine the root cause of the problem.

[0120] In some embodiments, the information point data corresponding to the sample file of the PoC type includes: PoC source code, which is used to assist in locating the problem, analyzing the problem logic, and evaluating the exploitability.

[0121] In some embodiments, the information point data corresponding to the sample file of the kernel source code type includes: kernel source code, which is used to assist in locating the problem and determining the problem type.

[0122] In some embodiments, the information point data corresponding to the sample file of the vmlinux type includes: vmlinux image, which is used to assist in locating the problem and determining the problem type.

[0123] Exemplarily, taking the kernel fuzzing tool syzkaller as an example, the sample directory topology generated by the tool is shown in Figure 4 Figure 4 In the sample directory topology, a folder named crashes is shown, which contains a subfolder with the name 3f4dddea529ae412e52bb0e870eaa033b8d4d691. The subfolder contains multiple data with names such as description, log0, log1, log2, machineInfo0, machineInfo1, machineInfo2, report0, report1, report2, etc.

[0124] Exemplarily, the above sample files can be parsed by corresponding target analysis plugins to obtain the following parsing results:

[0125] <sample>

[0126] <dir>Sample directory< / dir>

[0127] <too1>Fuzzing tool name< / too1>

[0128] <info>

[0129] <id>Information point id< / id>

[0130] <fi1e>Source file< / fi1e>

[0131] <content>Original content< / content>

[0132] <data>Parsed data< / data>

[0133] < / info>

[0134] < / sample> ​

[0135] The information point data includes information point number, source file, original content and parsed data. The data format is related to the information point type. Taking the information point data as a general register value, the specific data format is as follows:

[0136] <sample>

[0137] <dir>Sample directory< / dir>

[0138] <too1>Fuzzing tool name< / too1>

[0139]

[0140] The parsing results in the above examples mainly include: the directory path of the sample file, the name of the fuzz testing tool used, the specific information point data, the information point number, the source file, the original content, the parsed data (register name and corresponding value), etc.

[0141] For example, the following is the specific output result after the plug-in parses a certain sample file:

[0142]

[0143] In the above example, the output content includes the sample directory path (opt / crashes3f4dddea529ae412e52bb0e870eaa033b8d4d691), the name of the fuzz testing tool (syzkaller), the information point number (0), the file name (description), the original content (RAX:0000000000040000 RBX:ffff888061080068...), and the general register value, the value of register RAX is 0000000000040000, and the value of register RBX is ffff888061080068. This example shows the output of the target parsing plug-in, which describes the directory path, the name of the fuzz testing tool, the information point number, the file name, the original content, and the general register value in a unified format, which helps systematic analysis and vulnerability detection.

[0144] Taking a sample file of the kernel log type as an example, the content of the sample file can include:

[0145] BUG: KASAN: slab-use-afer-free in skb_queue_purge_reason+0xb9 net / core / skbuff.c:3877

[0146] Read of size 8 at addr ffff8880118db058 by task syz-executor

[0147] CPU: 1 PID: 9233 Comm: syz-executor

[0148] Call Trace:

[0149] skb_queue_purge_reason+0xb9 / 0x500 net / core / skbuff:3877 [...]

[0151] do_syscall_x64 arch / x86 / entry / common.c:52 [inline]

[0152] RIP:0033:0x7fdbb787cee9

[0153] Code:28 00 00 00 75 05 48 83c4 28c3 e8 e1 20 00 00 90 48 89f8 48 89f74889d6 48 89ca 4d 89c2 4d 89c8 4c 8b 4c 24 08 0f 05<48>3d 01ff ff 73 01c348c7 c1 b0 ff ff f7 d8 64 89 01 48

[0154] RSP:002b:00007fdbb85530c8 EFLAGS:00000246 ORIG_RAX:0000000000000010

[0155] RAX:fffffffffda RBX:00007fdbb79abf80 RCX:00007fdbb787cee9

[0156] RDX:0000000000000000 RS1:00000000400448c6 RDI:0000000000000006

[0157] RBP:00007fdb678c949e R08:0000000000000000 R09:0000000000000000

[0158] R10:0000000000000000 R11:0000000000000246 R12:0000000000000000

[0159] R13:0000000000000006 R14:00007fdbb79abf80 R15:00007ffea6376cb8

[0160] Among the multiple information point data corresponding to the above sample file, "BUG: KASAN: slab-use-after-free" indicates the problem type; "skb_queue_purge_reason+0xb9" is the crash location; "CPU: 1" is the CPU number; "PID: 9233" is the process PID; "Comm: syz-executor" is the process name; "skb_queue_purge_reason+0xb9 / 0x500 net / core / skbuff:3877 [...]" is the call stack backtrace; "RIP: 0033:0x7fdbb787cee9" is the program counter value; "Code: 28 00 00 00 75 05 4883c4 28c3 e8 e1 20 00 00 90 48 89f8 48 89f7 48 89d6 48 89ca 4d 89c2 4d 89c8 4c 8b 4c24 08 0f 05<48>3d 01ff ff 73 01 c3 48c7 c1 b0 ff ff f7 d8 64 89 01 48" is the instruction code at the crash location; "RSP: 002b:0x7fdbb85530c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: fffffffffda RBX: 0x7fdbb79abf80 RCX: 0x7fdbb787cee9 RDX: 0x0000000000000000 RSI: 0x00000000400448c6 RDI: 0x0000000000000006 RBP: 0x7fdb678c949e R08: 0x0000000000000000 R09: 0x0000000000000000 R10: 0x0000000000000000 R11: 0x0000000000000246

[0161] 12: 0x0000000000000000 R13: 0x0000000000000006 R14: 0x7fdbb79abf80 R15: 0x7ffea6376cb8" is the general register value; "Read of" is the out-of-bound access type (read memory); "size 8" is the out-of-bound access length (8 bytes).

[0162] In the embodiments of the present application, the scheme realizes an efficient and systematic kernel suspected vulnerability sample analysis process through automatic and structured data analysis and comprehensive key information extraction, thereby effectively improving sample analysis and vulnerability mining efficiency.

[0163] In some embodiments, in S22, determining whether the sample file satisfies the preset integrity condition according to the plurality of information point data includes S221-S223.

[0164] S221, determining whether the plurality of information point data contains at least one preset information point data set.

[0165] In some embodiments, the preset information point data set can include: a first data set (including PoC source code and a function at a crash location), a second data set (including PoC source code and a stack backtrace), a third data set (including PoC source code and a program counter value), a fourth data set (including PoC source code, a crash location instruction code, and vmlinux), a fifth data set (including PoC source code and a value saved on a stack), a sixth data set (including a system call sequence and parameters and a function at a crash location), a seventh data set (including a system call sequence and parameters and a stack backtrace), an eighth data set (including a system call sequence and parameters and a program counter value), a ninth data set (including a system call sequence, a crash location instruction code, and vmlinux), a tenth data set (including a system call sequence and parameters and a value saved on a stack), an eleventh data set (including a stack backtrace, a problem type, a general register value, and kernel source code), a twelfth data set (including a stack backtrace, a problem type, a general register value, and vmlinux), a thirteenth data set (including a value saved on a stack, a problem type, a general register value, and kernel source code), and a fourteenth data set (including a value saved on a stack, a problem type, a general register value, and vmlinux).

[0166] That is, when the plurality of information point data contains PoC source code or a system call sequence, if it is known that the problem is located in a function, the problem can be analyzed. Specifically, the following situations can locate the problem function: the stack backtrace information contains the problem function; and / or, the problem function is located according to the program counter value and the symbol table; and / or, the problem function is located in vmlinux according to the crash location instruction code; and / or, the stack frame saves the stack backtrace information. In addition, if the plurality of information point data does not contain PoC source code or a system call sequence, the problem can be analyzed according to the stack backtrace information before the kernel crashes. At this time, it is necessary to know the problem type, the value of the general register when the problem occurs, and the kernel code (source code or vmlinux).

[0167] S222, in the case that the plurality of information point data contains at least one of the preset information point data sets, it is determined that the plurality of information point data satisfies the preset integrity condition.

[0168] That is, if the set of the plurality of information point data is a superset of any one of the preset information point data sets, it can be considered that the plurality of information point data has analyzability, that is, satisfies the preset integrity condition.

[0169] S223, in the case that the plurality of information point data does not contain any of the preset information point data sets, it is determined that the plurality of information point data does not satisfy the preset integrity condition.

[0170] When the plurality of information point data does not contain at least one of the preset information point data sets, it can be considered that the problem reflected by the information point data does not have analyzability.

[0171] In the embodiments of the present application, by judging whether the sample file contains the key preset information point data set, manual checking is not required, the efficiency of the kernel suspected vulnerability sample analysis process is improved, and sample files that satisfy the analysis condition can be quickly screened out. In addition, by defining a plurality of information point data sets (such as crash location, call stack backtracking, program counter value, etc.), the system can determine whether it has key analysis information, and the inclusion of these information point data sets can provide sufficient information for problem positioning during analysis. For example, knowing the crash location function and stack backtracking information can directly locate the problem function, reducing the complexity and time cost of problem positioning, and improving the effectiveness of analysis.

[0172] In some embodiments, in S23, the determination of the analyzability information of the kernel suspected vulnerability includes S231-S235:

[0173] S231, obtaining a first preset score corresponding to each first information point data in the plurality of information point data, and a second information point data corresponding to the information value, the second information point data is used to indicate the number of reproductions.

[0174] Among the plurality of information point data, the first information point data and the second information point data are included, and the first information point data is information point data other than the second information point data used to indicate the number of reproductions.

[0175] In some embodiments, each first information point data in the plurality of information point data has a preset score, that is, a first preset score, which can be calculated based on historical data, experience rules or algorithms. The first preset score corresponding to each first information point data is fixed, which can be understood as quantifying the "importance" or "influence" of the first information point data.

[0176] S232. Calculate the sum of the first preset scores corresponding to each of the first information point data.

[0177] The first preset score of all the first information point data is summed to obtain a total value, which is equivalent to summing the "weights" of all the first information point data.

[0178] S233. The product of the sum of the above-mentioned first preset scores and the above-mentioned information value is determined as the analyzability score of the above-mentioned suspected kernel vulnerability.

[0179] In some embodiments, the second information point data used to indicate the number of recurrences does not correspond to a pre-set first preset score. The number of recurrences has additional weight for the analyzability of the information point data; the more recurrences, the more valuable the data is for analysis. Therefore, the value corresponding to the number of recurrences is used as a multiplication factor.

[0180] In this embodiment, a fixed first preset score is assigned to each first information point data to quantify its importance, thus objectively reflecting the influence of different information point data in the calculation. Furthermore, the frequency of recurrence (second information point data) is used as a multiplier factor in the calculation. It has no preset score; the higher the frequency of recurrence, the more valuable the information point is for analysis, and therefore it carries greater weight in the analysibility score. By combining importance and frequency of recurrence, the bias that may result from considering only a single factor is avoided, making the analysibility score more accurate and reliable.

[0181] In some embodiments, the analyzability information further includes an analyzability level. In S23, the analyzability information used to determine the suspected kernel vulnerability includes S236-S238:

[0182] S236. Obtain multiple scoring intervals corresponding to multiple preset reference levels.

[0183] In some embodiments, a set of reference levels (such as "high", "medium", and "low") can be predefined, and a scoring range can be set for each level. For example: high analyzability level: score between 8 and 10; medium analyzability level: score between 5 and 7; low analyzability level: score between 0 and 4.

[0184] S237. Determine the target score range to which the above analyzability score belongs.

[0185] For each piece of data to be analyzed, its analyzability score is calculated, and then it is determined which preset score interval the analyzability score falls into. By matching the score interval, the degree of analyzability of the information point data is objectively evaluated, avoiding subjective judgment.

[0186] S238, determine the reference level corresponding to the target score interval as the analyzability level of the kernel suspected vulnerability.

[0187] According to the found score interval, the corresponding reference level is determined and used as the analyzability level of the kernel suspected vulnerability. The specific score is converted into a level label that is easier to understand and use, facilitating subsequent analysis and decision-making.

[0188] In the embodiments of the present application, by sorting the kernel suspected vulnerabilities according to the analyzability score, the samples that lack important information and cannot be analyzed are filtered out. The security experts can avoid wasting too much effort on samples with low analyzability, and improve the overall analysis efficiency.

[0189] In some embodiments, in S24, the determination of the exploitability information of the kernel suspected vulnerability includes S241-S242:

[0190] S241, determine the problem type and key element information of each information point data in the plurality of information point data.

[0191] In some embodiments, the problem type of the information point data can be any one of the following: WARNING type, out-of-bound read type, array index out-of-bound type, out-of-bound write type, Use After Free (UAF) type, and Double Free type.

[0192] In some embodiments, the key element information of the information point data of the WARNING type is the general register value; the key element information of the information point data of the out-of-bound read type is the memory type, access offset, and read length; the key element information of the information point data of the array index out-of-bound type is the access type; the key element information of the information point data of the out-of-bound write type is the memory type, access offset, and read length; the key element information of the information point data of the UAF type is the CPU number, process ID, process name, and out-of-bound access heap size; and the key element information of the information point data of the Double Free type is the CPU number, process ID, process name, and out-of-bound access heap size.

[0193] S242, determine the exploitability score of the kernel suspected vulnerability based on the problem type and key element information of each information point data.

[0194] In the embodiments of the present application, by determining the problem type and collecting the key element information, the difficulty of writing a vulnerability exploit program can be evaluated, and the harm degree of the vulnerability can be indirectly reflected. By comprehensively analyzing the above-mentioned analyzability and exploitability scores, a security expert can quickly identify high-value vulnerabilities and prioritize root cause analysis of such vulnerabilities, thereby improving the efficiency and quality of vulnerability mining.

[0195] In some embodiments, in S242, the exploitability score of the above-mentioned kernel suspected vulnerability is determined based on the problem type and the key element information of the above-mentioned each information point data, including S2421-S2424:

[0196] S2421, for each information point data, the scoring rule corresponding to the information point data is obtained according to the problem type of the information point data.

[0197] In some embodiments, the exploitability condition is a judgment standard set for information point data of different problem types, for determining whether the information point data has exploit value.

[0198] In some embodiments, the scoring rule is pre-set, and can be set according to the following aspects: how to determine whether the kernel address space layout randomization (KASLR) can be bypassed according to the register information; how to determine whether the kernel heap address can be leaked according to the register information; how to determine whether the function pointer can be leaked according to the register information; how to determine the influence of the size of the heap on the exploitability; how to determine the influence of the type of the heap on the exploitability; how to determine whether it is a race condition; whether special permissions are required to trigger the vulnerability through the unshare system call in static analysis; and whether special permissions are required to trigger the vulnerability in different configurations of the environment.

[0199] In some embodiments, the information point data of the WARNING type can cause kernel information leakage, and the user mode can bypass the kernel address randomization KASLR or determine the kernel heap address. Therefore, the exploitability condition corresponding to the information point data of the WARNING type is that the kernel prints the value of the register in the log, and a certain register happens to save the address of the kernel image (code segment, data segment) or the heap. That is, the scoring rule corresponding to the information point data of the WARNING type is that only in the case of containing the register value, and the value must be the address of the image or the heap, has exploitability.

[0200] In some embodiments, the availability of the information point data of the out-of-bound read type is affected by three factors: memory type, access offset, and read length. The scoring rule corresponding to the information point data of the out-of-bound read type is that, when the problem occurs on the stack, the kernel may accidentally copy function local variables, stack overflow protection Canary, function return addresses and other information to the user state, and the user state bypasses KASLR or further attacks the kernel in combination with the stack overflow problem. When the problem occurs on the heap, the kernel may accidentally copy function pointers, keys, and other information to the user state, thereby leaking critical information; the access offset can assist in confirming whether the out-of-bound read is a continuous read or a jump read, the latter being more flexible in exploitation; the longer the read length, the more content is leaked, and the higher the exploitability score.

[0201] In some embodiments, when an array out-of-bound access occurs, the availability of writing is higher than that of reading. If the information point data of the out-of-bound write type occurs on the heap, the module will further analyze the size of the heap. The size of the heap affects the exploitability, and the module considers it from two dimensions: difficulty of placement and number of candidate objects. For example, kmalloc-128 heap is used more frequently than kmalloc-4096 heap, and the difficulty of heap layout on kmalloc-128 heap is higher than that on kmalloc-4096 heap, but the number of candidate objects using kmalloc-4096 heap is less than that using kmalloc-128 heap, and the exploitability score is lower.

[0202] In some embodiments, the information point data of the UAF type usually occurs on the heap, and the module first confirms whether the triggering method is a race condition. The UAF caused by the race condition may be difficult to trigger stably, and the triggering process may be affected by the state of the kernel load. The exploitability score of the UAF of the non-race condition is higher. The module determines whether the problem is a race UAF according to whether the allocation and release processes are located in the same CPU and the same process. Secondly, the module will analyze the size of the heap, and the analysis logic is consistent with that of the out-of-bound write.

[0203] In some embodiments, the analysis process of the information point data of the Double Free type is consistent with that of the UAF type.

[0204] In some embodiments, the module confirms the required permissions of the problem according to the PoC source code, and the analysis method includes static analysis and dynamic analysis. First, the PoC source code is statically analyzed to identify permission-related system calls therein, such as creating a namespace through the unshare system call. Then, the source code is compiled into an executable file, and the executable file is run under different permission configurations to determine whether the problem reflected by the information point data can be triggered without special permissions. The problems that can be triggered under normal permissions have a higher exploitability score than the problems that can only be triggered under special permissions.

[0205] S2422, determine a second preset score corresponding to the information point data according to the key element information of the information point data and the scoring rule.

[0206] In some embodiments, the key element information of the information point data can be analyzed based on the above-mentioned rule to score the information point data, and obtain the second preset score corresponding to each information point data.

[0207] S2424, add the second preset score corresponding to each information point data to determine the exploitability score of the kernel suspected vulnerability.

[0208] Add the second preset scores of all information point data to obtain the overall exploitability score of the kernel suspected vulnerability. The exploitability score reflects the possibility of the kernel suspected vulnerability being exploited by an attacker and the potential risk degree. A higher exploitability score means that the vulnerability is easy to exploit, the trigger condition is simple, no special permission is required, and the exploitation method is various, so it needs to be analyzed first.

[0209] In the embodiments of the present application, by setting detailed scoring rules for different types of problems, the damage degree and exploitability of each vulnerability can be more accurately evaluated. Among them, the scoring rules consider multiple key factors, such as memory location, access type, trigger condition, permission requirement, etc., so that the evaluation result is more comprehensive and reliable.

[0210] In some embodiments, the exploitability information can also include an exploitability level, which can be determined according to the exploitability score. The specific steps are similar to the process of determining the analyzability level according to the analyzability score in S236-S238 described above, which will not be repeated here.

[0211] Figure 5 A specific flowchart of a kernel suspected vulnerability sample analysis method provided by an exemplary embodiment of the present application is shown in FIG. 5, which includes S501-S507. Figure 5

[0212] S501, obtain a plurality of information point data included in a sample file of a kernel suspected vulnerability.

[0213] Optionally, the specific steps of S501 are consistent with S21 described above, which will not be repeated here.

[0214] S502, determine whether the plurality of information point data contains at least one preset information point data set. If not, execute S503, if yes, execute S504.

[0215] S503, determine that the plurality of information point data does not meet the preset integrity condition. ​

[0216] S504, determine whether the plurality of information point data satisfies a preset integrity condition.

[0217] Optionally, the specific steps of S502-S504 are consistent with S221-S223 described above, and will not be repeated here.

[0218] S505, determine the analyzability information of the kernel suspected vulnerability.

[0219] S506, determine the exploitability information of the kernel suspected vulnerability.

[0220] S507, generate an analysis report of the sample file.

[0221] Optionally, the specific steps of S505-S507 are consistent with S23 described above, and will not be repeated here.

[0222] Optionally, in the case where it is determined that the plurality of information point data does not satisfy the preset integrity condition, an analysis report of the sample file can be directly generated, and the vulnerability analysis report can clearly indicate which information point data is missing, resulting in not satisfying the preset integrity condition.

[0223] By gradually extracting information, judging data integrity, evaluating analyzability and exploitability, a valuable vulnerability sample analysis report is finally generated, which provides effective support for security experts to make reasonable decisions.

[0224] In some embodiments, the analysis report described above can be displayed on the display of the terminal for relevant personnel to view and analyze the problems reflected by the kernel suspected vulnerability.

[0225] In some embodiments, the analysis report described above can also include detailed content of the information point data related to the analyzability score, and detailed content of the information point data related to the exploitability score.

[0226] Figure 6 A page schematic diagram of an analysis report provided for an exemplary embodiment of the present application is shown in FIG. 6. Figure 6 As shown, the analysis report includes: the title "feasibility analysis report", the conclusion table and the information point detail table. The conclusion table includes the problem "BUG: KASAN: slab-use-after-free" reflected by the kernel suspected vulnerability, and the analyzability level "medium", the analyzability score "5", the exploitability level "low", the exploitability score "3", the vulnerability type "Use After Free read", the required permission "low", the memory type "heap", the memory attribute "kmalloc-1k,8,88", the number of reproductions "2", and the directory, analysis time and other information. The information point detail table includes information point data such as problem type and occurrence position, and corresponding extracted information content "BUG: KASAN: slab-use-after-free" and "skb_queue_purge_reason+0xb9 / 0x500 net / core / skbuff.c:3877".

[0227] The above vulnerability analysis report supports multi-dimensional report filtering, which facilitates relevant personnel to quickly identify high-value vulnerabilities and effectively improves vulnerability mining efficiency.

[0228] Next, please refer to Figure 7 , which is a structural schematic diagram of a kernel suspected vulnerability sample analysis device provided by an exemplary embodiment of the present application. As shown in Figure 7 , the kernel suspected vulnerability sample analysis device 700 includes:

[0229] The acquisition module 701 is configured to acquire a plurality of information point data included in a kernel suspected vulnerability sample file, and the sample file includes abnormal information captured in fuzz testing.

[0230] The first determination module 702 is configured to determine whether the sample file meets a preset integrity condition according to the plurality of information point data.

[0231] The second determination module 703 is configured to determine the analyzability information of the kernel suspected vulnerability and the exploitability information of the kernel suspected vulnerability when the sample file meets the preset integrity condition, wherein the analyzability information includes an analyzability score, and the exploitability information includes an exploitability score.

[0232] The generation module 704 is configured to generate an analysis report of the sample file based on the analyzability information and the exploitability information.

[0233] In a possible implementation manner, the acquisition module 701 includes:

[0234] The first determination unit is configured to determine the file type corresponding to the kernel suspected vulnerability sample file.

[0235] a second determining unit, configured to determine a target analysis plug-in corresponding to the sample file based on the file type;

[0236] an analysis unit, configured to analyze the sample file by using the target analysis plug-in to obtain a plurality of information point data included in the kernel suspected vulnerability sample file.

[0237] In a possible implementation, the first determining module 702 includes:

[0238] a first judging unit, configured to judge whether the plurality of information point data contains at least one preset information point data set;

[0239] a third determining unit, configured to determine that the plurality of information point data satisfies the preset integrity condition in a case where the plurality of information point data contains at least one preset information point data set;

[0240] a fourth determining unit, configured to determine that the plurality of information point data does not satisfy the preset integrity condition in a case where the plurality of information point data does not contain any preset information point data set.

[0241] In a possible implementation, the second determining module 703 includes:

[0242] a first obtaining unit, configured to obtain a first preset score corresponding to each first information point data in the plurality of information point data, and an information value corresponding to second information point data, the second information point data being used to indicate a number of reproductions;

[0243] a calculating unit, configured to calculate a sum of the first preset scores corresponding to each first information point data;

[0244] a fifth determining unit, configured to determine a product of the sum of the first preset scores and the information value as an analyzability score of the kernel suspected vulnerability.

[0245] In a possible implementation, the analyzability information further includes an analyzability level, and the second determining module 703 includes:

[0246] a second obtaining unit, configured to obtain a plurality of score intervals corresponding to a plurality of reference levels;

[0247] a sixth determining unit, configured to determine a target score interval to which the analyzability score belongs;

[0248] a seventh determining unit, configured to determine a reference level corresponding to the target score interval as the analyzability level corresponding to the kernel suspected vulnerability.

[0249] In a possible implementation, the second determining module 703 includes:

[0250] An eighth determining unit, configured to determine a question type and key element information of each information point data in the plurality of information point data.

[0251] A ninth determining unit, configured to determine an exploitability score of each information point data based on the question type and the key element information of the information point data.

[0252] In a possible implementation, the ninth determining unit includes:

[0253] An obtaining sub-unit, configured to obtain, for each information point data, a scoring rule corresponding to the information point data according to a question type of the information point data.

[0254] A first determining sub-unit, configured to determine a second preset score corresponding to the information point data according to the key element information of the information point data and the scoring rule.

[0255] A second determining sub-unit, configured to determine a sum of the second preset scores corresponding to each information point data as the exploitability score of the kernel suspected vulnerability.

[0256] The division of the modules in the kernel suspected vulnerability sample analysis apparatus 700 is only for example, and in other embodiments, the kernel suspected vulnerability sample analysis apparatus can be divided into different modules as needed to complete all or part of the functions of the kernel suspected vulnerability sample analysis apparatus. The implementation of each module in the kernel suspected vulnerability sample analysis apparatus provided in the embodiments of the present specification can be in the form of a computer program. The computer program can run on a terminal or a server. The program modules formed by the computer program can be stored on the memory of the terminal or the server. When the computer program is executed by the processor, all or part of the steps of the kernel suspected vulnerability sample analysis method described in the embodiments of the present specification are implemented.

[0257] Next, please refer to Figure 8 , which is a structural schematic diagram of an electronic device provided by an example embodiment of the present application. As Figure 8 shown, the electronic device 800 can include a processor 810 and a memory 820, and can further include a user interface 830, a network interface 840, and a communication bus 850.

[0258] The processor 810 can include one or more processing cores. The processor 810 connects various parts within the entire electronic device 800 by various interfaces and lines, and performs various functions of the electronic device 800 and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 820, and calling data stored in the memory 820. Alternatively, the processor 810 can be implemented in at least one of a hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA). The processor 810 can integrate a combination of one or several of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes operating systems and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; and the modem is used for processing wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 810, but can be realized by a separate chip.

[0259] The memory 820 can include a random access memory (RAM) and can also include a read-only memory (ROM). Alternatively, the memory 820 includes a non-transitory computer-readable storage medium. The memory 820 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 820 can include a program storage area and a data storage area, wherein the program storage area can store instructions for implementing an operating system, instructions for at least one function (such as a receiving function, a control function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area can store data involved in the above-mentioned various method embodiments, etc. The memory 820 can alternatively be at least one storage device located away from the aforementioned processor 810. As shown, the memory 820 as a computer storage medium can include an operating system, a network communication module, a user interface module, and program instructions. Figure 8 As shown, the memory 820 as a computer storage medium can include an operating system, a network communication module, a user interface module, and program instructions.

[0260] Optionally, the communication bus 850 is used to realize the connection communication between the components, the user interface 830 can include a display screen (Display), a camera (Camera), and can also include a standard wired interface, a wireless interface; the network interface 840 can optionally include a standard wired interface, a wireless interface (such as a Wi-Fi interface).

[0261] In Figure 8 In the electronic device 800 shown, the processor 810 can be used to invoke the program instructions stored in the memory 820, and specifically perform the following operations:

[0262] Obtain a plurality of information point data included in a kernel suspected vulnerability sample file, the sample file including exception information captured in fuzz testing;

[0263] Determine whether the sample file meets a preset integrity condition according to the plurality of information point data;

[0264] In the case where the sample file meets the preset integrity condition, determine analyzability information of the kernel suspected vulnerability and exploitability information of the kernel suspected vulnerability, the analyzability information including an analyzability score, and the exploitability information including an exploitability score;

[0265] Generate an analysis report of the sample file based on the analyzability information and the exploitability information.

[0266] In one possible implementation, the obtaining of the plurality of information point data included in the kernel suspected vulnerability sample file includes:

[0267] Determine a file type corresponding to the sample file of the kernel suspected vulnerability;

[0268] Determine a target parsing plug-in corresponding to the sample file based on the file type;

[0269] Parse the sample file through the target parsing plug-in to obtain the plurality of information point data included in the kernel suspected vulnerability sample file.

[0270] In one possible implementation, the determining of whether the sample file meets the preset integrity condition according to the plurality of information point data includes:

[0271] Determine whether the plurality of information point data contains at least one preset information point data set;

[0272] In the case where the plurality of information point data contains at least one preset information point data set, determine that the plurality of information point data meets the preset integrity condition;

[0273] In a case where none of the plurality of information point data includes any of the preset information point data set, it is determined that the plurality of information point data does not satisfy the preset integrity condition.

[0274] In a possible implementation, the determining of the analyzability information of the kernel suspected vulnerability comprises:

[0275] obtaining a first preset score corresponding to each first information point data in the plurality of information point data, and an information value corresponding to second information point data, the second information point data being used to indicate a number of reproductions;

[0276] calculating a sum of the first preset scores corresponding to each first information point data;

[0277] determining a product of the sum of the first preset scores and the information value as an analyzability score of the kernel suspected vulnerability.

[0278] In a possible implementation, the analyzability information further comprises an analyzability level, and the determining of the analyzability information of the kernel suspected vulnerability comprises:

[0279] obtaining a plurality of score intervals corresponding to a plurality of reference levels;

[0280] determining a target score interval to which the analyzability score belongs;

[0281] determining a reference level corresponding to the target score interval as the analyzability level of the kernel suspected vulnerability.

[0282] In a possible implementation, the determining of the exploitability information of the kernel suspected vulnerability comprises:

[0283] determining a problem type and key element information of each information point data in the plurality of information point data;

[0284] determining an exploitability score of the kernel suspected vulnerability based on the problem type and the key element information of each information point data.

[0285] In a possible implementation, the determining of the exploitability score of the kernel suspected vulnerability based on the problem type and the key element information of each information point data comprises:

[0286] for each information point data, obtaining a score rule corresponding to the information point data according to the problem type of the information point data;

[0287] determining a second preset score corresponding to the information point data according to the key element information of the information point data and the score rule;

[0288] The sum of the second preset scores corresponding to each information point data is determined as the exploitability score of the kernel suspected vulnerability.

[0289] The embodiments of the present application further provide a computer readable storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor performs one or more steps of the above-mentioned embodiments. The constituent modules of the kernel suspected vulnerability sample analysis device can be stored in the computer readable storage medium if they are realized in the form of software function units and sold or used as independent products.

[0290] In the above embodiments, all or part of the embodiments can be realized by software, hardware, firmware, or any combination thereof. When realized by software, all or part of the embodiments can be realized in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted by the computer readable storage medium. The computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through a wired (such as coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more available media sets. The available media can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a digital versatile disc (Digital Versatile Disc, DVD)), or a semiconductor medium (such as a solid state disk (Solid State Disk, SSD)), etc.

[0291] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware, which can be stored in a computer readable storage medium. The program can include the processes of the above-mentioned embodiments when executed. The storage medium includes ROM, RAM, magnetic or optical disk, and various program code storage media. In the case of no conflict, the technical features in the embodiments and the embodiments can be combined arbitrarily.

[0292] The above embodiments are merely preferred embodiments of the present application and are not intended to limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements to the technical solutions of the present application made by those of ordinary skill in the art shall fall within the protection scope of the present application as defined by the claims.< / sample>

Claims

1. A method for analyzing a kernel suspected vulnerability sample, characterized in that, The method comprises the following steps: acquiring a plurality of information point data included in a sample file of a kernel suspected vulnerability, the sample file including exception information captured in fuzz testing; determining whether the sample file meets a preset integrity condition according to the plurality of information point data; in the case that the sample file meets the preset integrity condition, determining analyzability information of the kernel suspected vulnerability, wherein the analyzability information includes an analyzability score, and determining exploitability information of the kernel suspected vulnerability, wherein the exploitability information includes an exploitability score; generating an analysis report of the sample file based on the analyzability information and the exploitability information; the step of determining whether the sample file meets a preset integrity condition according to the plurality of information point data comprises the following steps: judging whether the plurality of information point data contains at least one preset information point data set; in the case that the plurality of information point data contains at least one preset information point data set, determining that the plurality of information point data meets the preset integrity condition; the step of determining the analyzability information of the kernel suspected vulnerability comprises the following steps: acquiring a first preset score corresponding to each first information point data in the plurality of information point data, and an information value corresponding to a second information point data, wherein the second information point data is used to indicate a number of reproductions; calculating a sum of the first preset scores; and determining a product of the sum of the first preset scores and the information value as the analyzability score of the kernel suspected vulnerability; wherein, the preset information point data set comprises: a first data set including PoC source code and a function where a crash position is located, a second data set including PoC source code and call stack backtracking, a third data set including PoC source code and a program counter value, a fourth data set including PoC source code, a crash position instruction code and vmlinux, a fifth data set including PoC source code and values saved on a stack, a sixth data set including a system call sequence and parameters and a function where a crash position is located, a seventh data set including a system call sequence and parameters and call stack backtracking, an eighth data set including a system call sequence and parameters and a program counter value, a ninth data set including a system call sequence, a crash position instruction code and vmlinux, a tenth data set including a system call sequence and parameters and values saved on a stack, an eleventh data set including call stack backtracking, a problem type, a general register value and kernel source code, a twelfth data set including call stack backtracking, a problem type, a general register value and vmlinux, a thirteenth data set including values saved on a stack, a problem type, a general register value and kernel source code, and a fourteenth data set including values saved on a stack, a problem type, a general register value and vmlinux.

2. The method of claim 1, wherein, The method comprises the following steps: determining a file type corresponding to a sample file of a kernel suspected vulnerability; determining a target analysis plug-in corresponding to the sample file based on the file type; The target analysis plug-in is used to analyze the sample file, and a plurality of information point data included in the sample file of the kernel suspected vulnerability is obtained.

3. The method of claim 1, wherein, The determination of whether the sample file meets a preset integrity condition according to the plurality of information point data includes: In a case where none of the plurality of information point data contains any of the preset information point data sets, it is determined that the plurality of information point data does not meet the preset integrity condition.

4. The method of claim 1, wherein, The analyzability information further includes an analyzability level, and the determination of the analyzability information of the kernel suspected vulnerability includes: A plurality of reference levels corresponding to a plurality of score intervals are obtained. A target score interval to which the analyzability score belongs is determined. A reference level corresponding to the target score interval is determined as the analyzability level of the kernel suspected vulnerability.

5. The method of claim 1, wherein, The determination of the exploitability information of the kernel suspected vulnerability includes: The problem type and key element information of each information point data in the plurality of information point data are determined. Based on the problem type and key element information of each information point data, an exploitability score of the kernel suspected vulnerability is determined.

6. The method of claim 5, wherein, The determination of the exploitability score of the kernel suspected vulnerability based on the problem type and key element information of each information point data includes: For each information point data, a score rule corresponding to the information point data is obtained according to the problem type of the information point data. A second preset score value corresponding to the information point data is determined according to the key element information of the information point data and the score rule. The sum of the second preset score values corresponding to each information point data is determined as the exploitability score of the kernel suspected vulnerability.

7. A kernel suspected vulnerability sample analysis apparatus characterized by comprising: It includes: An acquisition module is configured to acquire a plurality of information point data included in a sample file of a kernel suspected vulnerability, the sample file including abnormal information captured in fuzz testing; A first determination module is configured to determine whether the sample file meets a preset integrity condition according to the plurality of information point data; A second determination module is configured to, in a case where the sample file meets the preset integrity condition, determine analyzability information of the kernel suspected vulnerability, and determine exploitability information of the kernel suspected vulnerability, the analyzability information including an analyzability score, and the exploitability information including an exploitability score; A generation module is configured to generate an analysis report of the sample file based on the analyzability information and the exploitability information. The first determination module includes: A first judgment unit is configured to determine whether at least one preset information point data set is contained in the plurality of information point data; A third determination unit is configured to, in a case where at least one of the preset information point data sets is contained in the plurality of information point data, determine that the plurality of information point data meets the preset integrity condition; The second determination module includes: A first acquisition unit is configured to acquire a first preset score value corresponding to each first information point data in the plurality of information point data, and an information value corresponding to second information point data, the second information point data being used to indicate a number of reproductions. a calculation unit configured to calculate a sum of the first preset scores corresponding to each of the first information point data; a fifth determination unit configured to determine the product of the sum of the first preset scores and the information value as the analyzability score of the kernel suspected vulnerability; The preset information point data set includes: a first data set including PoC source code and a function at a crash location, a second data set including PoC source code and a call stack trace, a third data set including PoC source code and a program counter value, a fourth data set including PoC source code, a crash location instruction code and vmlinux, a fifth data set including PoC source code and a value saved on a stack, a sixth data set including a system call sequence and parameters and a function at a crash location, a seventh data set including a system call sequence and parameters and a call stack trace, an eighth data set including a system call sequence and parameters and a program counter value, a ninth data set including a system call sequence, a crash location instruction code and vmlinux, a tenth data set including a system call sequence and parameters and a value saved on a stack, an eleventh data set including a call stack trace, a problem type, a general register value and kernel source code, a twelfth data set including a call stack trace, a problem type, a general register value and vmlinux, a thirteenth data set including a value saved on a stack, a problem type, a general register value and kernel source code, and a fourteenth data set including a value saved on a stack, a problem type, a general register value and vmlinux.

8. An electronic device, comprising: comprising: a processor and a memory; The memory stores a computer program, and the computer program is adapted to be loaded and executed by the processor to perform the steps of the method according to any one of claims 1 to 6.

9. A computer storage medium, characterized in that The computer storage medium stores a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to perform the steps of the method according to any one of claims 1 to 6.

Images