基于S2E的Use-After-Free漏洞检测方案  

USE-AFTER-FREE VULNERABILITIES DETECTION SCHEME BASED ON S2E

作　　者：冯震[1] 聂森[1] 王轶骏[1] 薛质[1] 

机构地区：[1]上海交通大学信息安全与工程学院,上海200240

出　　处：《计算机应用与软件》2016年第4期273-276,共4页Computer Applications and Software

基　　金：国家自然科学基金项目(61332010);高级XXX技术研究(秘密级)(CNITSEC-KY-2013-009/2)

摘　　要：Use-After-Free漏洞是由程序试图操作悬垂指针引起的。该类型漏洞近年来在针对浏览器客户端的攻击中变得愈发流行。提出一种针对Use-After-Free漏洞的检测算法,并据此实现检测方案UAFChecker。UAFChecker基于开源的多路径软件分析平台S2E,它通过挂钩关键的堆内存操作函数监控指针的生成,使用反汇编引擎BeaEngine在汇编层上跟踪指针的传播,通过收集和分析指针信息来检测漏洞。实验结果表明,配合Fuzzing技术UAFChecker成功定位和分析出IE8浏览器中存在的多个未被公开的Use-After-Free漏洞。Use-After-Free vulnerabilities are caused by the attempt of a program to operate on a dangling pointer. This type of vulnerability is growing rapidly in popularity,especially for exploiting web browsers. In this paper we propose a new algorithm to detect Use-After-Free vulnerabilities and implement the detection scheme UAFChecker accordingly. UAFChecker is based on S2E,an open source platform for in-vivo multi-path analysis of software systems. It monitors the creation of pointers by hooking key heap-operating functions and tracks the propagation of all pointers by using BeaEngine on assembly code level. Then it detects vulnerabilities by collection and analysis of information of pointers.Experimental result indicates that by collaborating with Fuzzing technology,UAFChecker succeeds in locating and analysing multiple 0-day Use-After-Free vulnerabilities in IE8 browser.

关 键 词：Use-after-free漏洞 漏洞检测 悬垂指针 污点传播 符号执行 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]