JavaScript引擎JIT代码的类型混淆缺陷检测器  

Type confusion vulnerability sanitizer in JavaScript engine JIT code

作　　者：孙力立 张培华 武成岗[1,2] 王喆 SUN Lili;ZHANG Peihua;WU Chenggang;WANG Zhe(State Key Laboratory of Processors,Institute of Computing Technology,Chinese Academy of Sciences,Beijing 100190;School of Computer Science and Technology,University of Chinese Academy of Sciences,Beijing 100190)

机构地区：[1]处理器芯片全国重点实验室(中国科学院计算技术研究所),北京100190 [2]中国科学院大学计算机科学与技术学院,北京100190

出　　处：《高技术通讯》2023年第3期251-260,共10页Chinese High Technology Letters

基　　金：国家自然科学基金(U1736208,61902374)资助项目。

摘　　要：类型混淆漏洞是近期在JavaScript引擎中集中爆发的一类漏洞。但是,受即时编译(JIT)代码的限制,以往的类型混淆缺陷的检测方法,无法用于检测JavaScript引擎JIT代码的类型混淆缺陷。本文提出了一种针对该类型缺陷的检测方法,并实现了检测器名为TC-JIT-San的JIT代码类型混淆缺陷检测器。该方法利用JIT代码执行流和数据类型之间关联性,将从JIT代码中识别数据类型的难题转为观察执行流的变化。TC-JIT-San通过观察执行流的变化情况是否符合正常执行逻辑,从而检测出类型混淆缺陷。实验结果表明,TC-JIT-San具有低开销、低漏报和误报的特点。其运行时开销是正常执行的1.84倍,平均漏报率和误报率为0%和0.11%。Type confusion is a type of vulnerability that has recently emerged in JavaScript engines.However,due to JIT(just-in-time)code limitations,prior type confusion sanitizers are unable to detect type confusion bugs in JavaScript engine JIT code.For the first time,this paper proposes a detection method for these bugs,as well as a sanitizer,TC-JIT-San.The method takes advantage of the correlation between the JIT codes execution flow and data types,converting the issue of recognizing data types in JIT code into observing changes in the execution flow.TCJIT-San detects type confusion bugs by observing whether changes in the execution flow comply with normal execution logic.Experiments show that TC-JIT-San has a low overhead,as well as a low number of false negatives and false positives.Its runtime overhead is 1.84 times that of normal execution,and its average false negative and false positive rates are 0%and 0.11%,respectively.

关 键 词：漏洞挖掘 动态检测器 软件缺陷检测 

分 类 号：TP311.52[自动化与计算机技术—计算机软件与理论] TP309[自动化与计算机技术—计算机科学与技术]