【摘要】 依据整数溢出漏洞特征,该文在对220个实际整数溢出漏洞分析的基础上提出了3种检测策略来缓解静态分析技术的高误报问题。结合静态分析可直接获取整数溢出类型信息及动态分析获取整数溢出漏洞准确的优点,提出了动静结合的整数溢出漏洞分析方法。先利用程序静态分析技术分析整数溢出并获取整数溢出类型等相关信息,动态分析根据静态分析得到的信息,使用自动插桩技术对代码进行插桩,结合漏洞特征设计的重构表达式运行具体符号执行以提高漏洞分析的准确率。动静结合的整数溢出漏洞分析方法减少误报效果较好:对Lighttpd-1.4.29进行检测时减少误报374条,占总量的67.3%;对Linux内核3.4版本进行检测时减少误报159 761条,占总量的98.2%;并最终成功分析出CVE-2011-4362、CVE-2013-1763整数溢出漏洞。更多还原

【Abstract】 Different software vulnerabilities have different characteristics.220 integer overflow vulnerabilities are analyzed to develop three kinds of detection strategies to reduce the false positives from static analyses.Static analyses identify the type of integer overflow while dynamic analyses accurately identify the integer overflow vulnerability.This method combines the advantages of the two analyses to detect vulnerabilities.The static analysis is used to detect the integer overflow and obtain the integer overflow type and related information.This information is then used by the dynamic analysis to insert hooks into the code using the automatic pile technique.Then,the algorithm calls the integer overflow marker interface and performs symbolic execution with the reconstruction expressions.This method is used to analyze the Lighttpd-1.4.29 and Linux kernel 3.4systems.This method can greatly reduce the number of false positives.The number of false positives for Lighttpd-1.4.29 is reduced by 374,accounting for67.3% of the total.The number of false positives for Linux kernel 3.4is reduced by 159 761,accounting for 98.2%of the total.This system also successfully finds the CVE-2011-4362 and CVE-2013-1763 integer overflow vulnerabilities.更多还原