Type Confusion Detection Using Context-Aware Cast Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to efficiently detect type confusion vulnerabilities in programs, particularly in union types and pointer types, leading to potential data leakage, alteration, and malicious code execution due to incorrect type calculations and missed indicator candidates.
Innovation Solution
A detection device that includes an enumeration unit to identify unsafe locations, a context extraction unit to trace execution contexts, and a verification unit to verify annotations using a theoretical solver, ensuring safe type conversions and handling pointer and refinement types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pointer analysis is performed to detect type confusion vulnerabilities, then detection capability is improved, but analysis complexity and computational cost increase significantly
Solution Approach 1:
The analysis is divided into two independent phases: (1) a lightweight structural type inspection phase that identifies potential type confusion locations without complex pointer analysis, and (2) a targeted verification phase using a theoretical solver only at locations flagged by the first phase. This segmentation reduces overall complexity while maintaining detection reliability.
Solution Approach 2:
The structural type inspection performs preliminary filtering to identify and extract candidate locations where type confusion is likely to occur. By performing this preliminary action before the heavy theoretical solving, the system avoids unnecessary complex analysis at safe locations, thereby reducing overall computational cost while maintaining comprehensive detection capability.
2Measurement precision
If theoretical solver is used to verify union type conditions, then detection accuracy is improved, but analysis time increases
Solution Approach 1:
Instead of applying the expensive theoretical solver to all union type locations, the system applies it only to the subset of locations identified as potentially unsafe by the structural type inspection. This partial application of the solver maintains high detection accuracy for critical vulnerabilities while significantly reducing overall analysis time by avoiding unnecessary computations at safe locations.
3Device complexity
If union type inspection is performed without considering pointer types, then analysis simplicity is maintained, but detection capability for pointer-related vulnerabilities is lost
Solution Approach 1:
The structural type inspection is designed to be universal, handling both non-pointer types and pointer types within the same analysis framework. It extracts execution contexts and identifies potential type confusion locations regardless of whether pointers are involved, thereby maintaining analysis simplicity while extending detection capability to cover pointer-related vulnerabilities as well.
Data Source
AI summary
An unsafe location enumeration unit (131) enumerates, based on a code of a program, locations that do not satisfy a predetermined condition indicating that type conversion is safe among locations where a type casting occurs in the program. A context extraction unit (132) transition an automaton corresponding to the locations enumerated by the unsafe location enumeration unit (131) and extract a context reaching the locations. A vulnerability verification unit (133) verifies whether the location extracted by the context extraction unit (132) satisfies an annotation prepared in advance.