APISan: Sanitizing API Usages through Semantic Cross-checking Insu - - PowerPoint PPT Presentation

▶
apisan sanitizing api usages through semantic cross
SMART_READER_LITE
LIVE PREVIEW

APISan: Sanitizing API Usages through Semantic Cross-checking Insu - - PowerPoint PPT Presentation

Sep 03, 2023 33 likes •924 views

APISan: Sanitizing API Usages through Semantic Cross-checking Insu Yun, Changwoo Min, Xujie Si, Yeongjin Jang, Taesoo Kim, Mayur Naik Georgia Institute of Technology 1 APIs in todays software are plentiful yet complex Example: OpenSSL

slide-1
SLIDE 1

APISan: Sanitizing API Usages through Semantic Cross-checking

Insu Yun, Changwoo Min, Xujie Si, Yeongjin Jang, Taesoo Kim, Mayur Naik Georgia Institute of Technology

1

slide-2
SLIDE 2

APIs in today’s software are plentiful yet complex

  • Example: OpenSSL
  • 3841

3841 APIs in [v1.0.2h]

  • 3718 in [v1.0.1t] -> 3841 in [v1.0.2h] (+1

+123 APIs)

  • OpenSSH uses 158

158 APIs of OpenSSL

2

slide-3
SLIDE 3

Complex APIs result in programmers’ mistakes

  • Problems in documentation
  • Incomplete: e.g., low details in hostname verification
  • Long: e.g., 43K lines in OpenSSL documentation
  • Lack: e.g., internal APIs
  • Lack of automatic tool support
  • e.g., missing formal specification and precise semantics

3

slide-4
SLIDE 4

Problem: API misuse can cause security problems

4

slide-5
SLIDE 5

Problem: API misuse can cause security problems

5

à MITM

slide-6
SLIDE 6

Problem: API misuse can cause security problems

6

à Code execution

slide-7
SLIDE 7

Problem: API misuse can cause security problems

7

à Privilege Escalation

slide-8
SLIDE 8

Today’s practices to help programmers

  • Formal method
  • Problem: lack of specification
  • Model checking
  • Problem: manual, lack of semantic context
  • Symbolic execution
  • Problem : failed to scale for large software

8

slide-9
SLIDE 9

Promising approach: finding bugs by using existing code

  • “Bugs as deviant behavior”[OSDI01]
  • Syntactic template: e.g., check NULL on malloc()
  • “Juxta”[SOSP15]
  • Inferring correct semantics from multiple of implementations
  • File system specific bug finding tool

9

slide-10
SLIDE 10

Promising approach: finding bugs by using existing code

  • “Bugs as deviant behavior”[OSDI01]
  • Syntactic template: e.g., check NULL on malloc()
  • “Juxta”[SOSP15]
  • Inferring correct semantics from multiple of implementations
  • File system specific bug finding tool

10

Research goal: can we apply this method to any kind of software without manual efforts?

slide-11
SLIDE 11

Our idea: comparing API usages in various implementation

  • Example: finding OpenSSL API misuses

11

APISan Majority uses ( Likely correct ) Deviant uses ( Likely bug)

…

curl curl curl nmap curl nginx nginx curl nmap nginx curl hexchat

slide-12
SLIDE 12

Our idea: comparing API usages in various implementation

  • Example: finding OpenSSL API misuses

12

APISan Majority uses ( Likely correct ) Deviant uses ( Likely bug)

…

curl curl curl nmap curl nginx nginx curl nmap nginx curl hexchat

slide-13
SLIDE 13

Our idea: comparing API usages in various implementation

  • Example: finding OpenSSL API misuses

13

APISan Majority uses ( Likely correct ) Deviant uses ( Likely bug)

…

curl curl curl nmap curl nginx nginx curl nmap nginx curl hexchat

slide-14
SLIDE 14

Our idea: comparing API usages in various implementation

  • Example: finding OpenSSL API misuses

14

APISan Majority uses ( Likely correct ) Deviant uses ( Likely bug)

…

curl curl curl nmap curl nginx nginx curl nmap nginx curl hexchat

slide-15
SLIDE 15

Our approach is very promising

  • Effective in finding API misuses
  • 76 new bugs
  • Scale to large, complex software
  • Linux kernel, OpenSSL, PHP, Python, etc.
  • Debian packages

15

slide-16
SLIDE 16

Technical Challenges

  • API uses are too different from impl. to impl.
  • Subtle semantics of the correct API uses
  • Large, complex code using APIs

16

slide-17
SLIDE 17

Example: OpenSSL API uses

  • SSL_get_verify_result()
  • Get result of peer certificate verification

17

if (SSL_get_verify_result() == X509_V_OK) { … }

slide-18
SLIDE 18

Example: OpenSSL API uses

  • SSL_get_verify_result()
  • Get result of peer certificate verification
  • no

no peer ce certificate à alw always retu turns X509_V_ V_OK OK

18

if (SSL_get_verify_result() == X509_V_OK) { … }

slide-19
SLIDE 19

Example: OpenSSL API uses

  • SSL_get_verify_result()
  • Get result of peer certificate verification
  • no

no peer ce certificate à alw always retu turns X509_V_ V_OK OK

19

if (SSL_get_verify_result() == X509_V_OK && SSL_get_peer_certificate() != NULL ) { … }

slide-20
SLIDE 20

Example: a correct implementation using OpenSSL API

20

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … }

cu curl

slide-21
SLIDE 21

Example: a correct implementation using OpenSSL API

21

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … }

cu curl

slide-22
SLIDE 22

Example: a correct implementation using OpenSSL API

22

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … }

cu curl

slide-23
SLIDE 23

Example: a correct implementation using OpenSSL API

23

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … }

cu curl

slide-24
SLIDE 24

Example: a correct implementation using OpenSSL API

24

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … }

cu curl

slide-25
SLIDE 25

Example: a correct implementation using OpenSSL API

25

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … }

cu curl

Semantically same with correct usage

if (SSL_get_verify_result() == X509_V_OK && SSL_get_peer_certificate() != NULL ) { … }

slide-26
SLIDE 26

Example: a correct implementation using OpenSSL API

26

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … }

cu curl

Correct

slide-27
SLIDE 27

Example: providing various implementations using OpenSSL

27

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat

Correct

slide-28
SLIDE 28

Example: providing various implementations using OpenSSL

28

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat

Correct

slide-29
SLIDE 29

Example: providing various implementations using OpenSSL

29

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat

Correct Correct

slide-30
SLIDE 30

Example: providing various implementations using OpenSSL

30

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat

Correct Correct

slide-31
SLIDE 31

Example: providing various implementations using OpenSSL

31

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat

Correct Correct Correct

slide-32
SLIDE 32

Example: providing various implementations using OpenSSL

32

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat

Correct Correct Correct

// // if (cer cert) is missed ed

slide-33
SLIDE 33

Example: providing various implementations using OpenSSL

33

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat

Correct Correct Correct Incorrect

// // if (cer cert) is missed ed

slide-34
SLIDE 34

Example: providing various implementations using OpenSSL

34

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat

Correct Correct Correct Incorrect

// // if (cer cert) is missed ed

Can we distinguish between correct implementations and buggy implementations?

slide-35
SLIDE 35

Challenge 1: API usages are different from each other

35

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat // // if (cer cert) is missed ed

Correct Correct Correct Incorrect

slide-36
SLIDE 36

Challenge 2: subtle semantics of the correct API usages

36

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl if (SSL_get_verify_result(conn) != X509_V_OK) return NGX_OK; cert = SSL_get_peer_certificate(conn); if (cert) { … } ng ngin inx cert = SSL_get_peer_certificate(ssl); if (cert == NULL) return 0; if (SSL_get_verify_result(ssl) != X509_V_OK) {…} nmap nmap err = SSL_get_verify_result(ssl); switch(err) { case X509_V_OK: cert = SSL_get_peer_certificate(ssl); he hexcha hat // // if (cer cert) is missed ed

Correct Correct Correct Incorrect

slide-37
SLIDE 37

Challenge3 : Large, complex code using APIs

  • On average, more than 100K LoC
  • curl : 110K LoC
  • nginx : 127K LoC
  • nmap: 169K LoC
  • hexchat: 61K LoC
  • Linux : > 1M LoC

37

slide-38
SLIDE 38

Challenge3 : Large, complex code using APIs

38

cert = SSL_get_peer_certificate(handle); if (!cert) {…} ... len = BIO_get_mem_data(mem, (char **) &ptr); infof(data, " start date: %.*s\n", len, ptr); rc = BIO_reset(mem); … err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err == X509_V_OK) { … } cu curl (simplified ed)

slide-39
SLIDE 39

Overview of APISan

39

Source code Source code Source code

slide-40
SLIDE 40

Overview of APISan

40

Source code Source code Source code APIs Arguments Constraints Symbolic execution database Relaxed Symbolic Execution

slide-41
SLIDE 41

Overview of APISan

41

Return value checker Argument checker Causality checker Condition checker 4 4 Ch Checkers Source code Source code Source code APIs Arguments Constraints Symbolic execution database Relaxed Symbolic Execution

slide-42
SLIDE 42

Overview of APISan

42

Return value checker Argument checker Causality checker Condition checker 4 4 Ch Checkers Source code Source code Source code APIs Arguments Constraints Symbolic execution database Relaxed Symbolic Execution

: minor, but not bug : minor and bug

…

Minority uses

slide-43
SLIDE 43

Overview of APISan

43

Return value checker Argument checker Causality checker Condition checker 4 4 Ch Checkers Source code Source code Source code APIs Arguments Constraints Symbolic execution database Relaxed Symbolic Execution

: minor, but not bug : minor and bug

…

Minority uses

...

Ranked minority uses

slide-44
SLIDE 44

Overview of APISan

44

Return value checker Argument checker Causality checker Condition checker 4 4 Ch Checkers Source code Source code Source code APIs Arguments Constraints Symbolic execution database Relaxed Symbolic Execution

: minor, but not bug : minor and bug

…

Minority uses

...

Ranked minority uses

slide-45
SLIDE 45

Symbolic execution can be relaxed in finding API contexts

  • Symbolic execution is not scalable
  • Path explosion
  • SMT is expensive, naturally NP-complete
  • Methods to relax symbolic execution
  • Limiting inter-procedural analysis
  • Removing back edges
  • Range-based

45

slide-46
SLIDE 46

Method 1: Limiting inter-procedural analysis

  • How APIs are used

O

  • How APIs are implemented

X

46

cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err != X509_V_OK) { … }

slide-47
SLIDE 47

Method 2: Removing back edges

  • API contexts can be captured within loops
  • e.g., malloc() and free() are matched inside a loop

47

for(…) { cert = SSL_get_peer_certificate(handle); if (!cert) {…} err = SSL_get_verify_result(handle); if (err != X509_V_OK) { … } }

slide-48
SLIDE 48

Method 3: Range-based

  • Most of arguments & return values are integer
  • Clang uses range-based symbolic execution

48

cert != NULL ∧ err == X509_V_OK cert = {[-MAX, -1] , [1, MAX]} err = {[X509_V_OK, X509_V_OK]}

slide-49
SLIDE 49

Building per-path symbolic abstractions

  • Path-sensitive, context-sensitive
  • Record symbolic abstractions
  • API calls
  • Symbolic expression of arguments
  • Constraints

49

slide-50
SLIDE 50

Examples: Building per-path symbolic abstractions from source code

50

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … } So Source ce co code Sy Symbolic abstractions

slide-51
SLIDE 51

Examples: Building per-path symbolic abstractions from source code

51

Call SSL_get_peer_certificate(handle) cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … } So Source ce co code Sy Symbolic abstractions

slide-52
SLIDE 52

Examples: Building per-path symbolic abstractions from source code

52

Call SSL_get_peer_certificate(handle) Constraint SSL_get_peer_certificate(handle) = {[-MAX, -1], [1, MAX]} cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … } So Source ce co code Sy Symbolic abstractions

slide-53
SLIDE 53

Examples: Building per-path symbolic abstractions from source code

53

Call SSL_get_peer_certificate(handle) Constraint SSL_get_peer_certificate(handle) = {[-MAX, -1], [1, MAX]} Call SSL_get_verify_result(handle) cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … } So Source ce co code Sy Symbolic abstractions

slide-54
SLIDE 54

Examples: Building per-path symbolic abstractions from source code

54

Call SSL_get_peer_certificate(handle) Constraint SSL_get_peer_certificate(handle) = {[-MAX, -1], [1, MAX]} Call SSL_get_verify_result(handle) Constraint SSL_get_verify_result(handle) = {[X509_V_OK, X509_V_OK]} cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … } So Source ce co code Sy Symbolic abstractions

slide-55
SLIDE 55

Examples: Building per-path symbolic abstractions from source code

55

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … } So Source ce code

slide-56
SLIDE 56

Examples: Building per-path symbolic abstractions from source code

56

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … } So Source ce code

Symbolic Abstractions #1

slide-57
SLIDE 57

Examples: Building per-path symbolic abstractions from source code

57

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … } So Source ce code

Symbolic Abstractions #1 Symbolic Abstractions #2

slide-58
SLIDE 58

Examples: Building per-path symbolic abstractions from source code

58

cert = SSL_get_peer_certificate(handle); if if (!cert) {…} err = SSL_get_verify_result(handle); if if (err == X509_V_OK) { … } So Source ce code

Symbolic Abstractions #1 …. Symbolic Abstractions #2 Symbolic Abstractions #3

slide-59
SLIDE 59

Overview of APISan

59

Return value checker Argument checker Causality checker Condition checker 4 4 Ch Checkers Source code Source code Source code APIs Arguments Constraints Symbolic execution database Relaxed Symbolic Execution

: minor, but not bug : minor and bug

…

Minority uses

...

Ranked minority uses

slide-60
SLIDE 60

Four semantic contexts have security implications

  • Orthogonal, essential, security-related contexts
  • Return value
  • Arguments
  • Causality
  • Condition

60

slide-61
SLIDE 61

Context 1: Return value

  • Return computation result or execution status
  • NULL dereference
  • Privilege escalation
  • e.g, Windows, CVE-2014-4113

61

ptr = malloc(size)

if if (! (!pt ptr){ ){ … } … }

slide-62
SLIDE 62

Context 2: Arguments

  • Inputs for calling APIs and their relationship
  • Format string bug
  • Memory corruption

62

printf(buf

buf);

ptr = malloc(siz

size1);

memcpy(ptr, src, siz

size2);

slide-63
SLIDE 63

Context 3: Causality

  • Causal relationship between APIs
  • Deadlock
  • Memory leak

63

lock();

unlock ck();

malloc();

fr free(); ();

slide-64
SLIDE 64

Context 4: Condition

  • Implicit pre- and post condition for calling APIs
  • MITM

64

if (SSL_get_verify_result() == X509_V_OK &&

SSL_get_peer_ce certificate() () != NULL)

slide-65
SLIDE 65

Extract contexts from symbolic abstractions

  • Symbolic abstractions contains

{A {API PIs, Arguments, Con

  • nstrain

aints}

  • Return value

ß Constraints

  • Arguments

ß Arguments

  • Causality

ß APIs

  • Condition

ß Constraints + APIs

65

slide-66
SLIDE 66

Extract contexts from symbolic abstractions

  • Symbolic abstractions contains

{A {API PIs, Arguments, Con

  • nstrain

aints}

  • Return value

ß Constraints

  • Arguments

ß Arguments

  • Causality

ß APIs

  • Condition

ß Constraints + APIs

66

slide-67
SLIDE 67

Example: extract condition contexts from symbolic abstractions

67

Call SSL_get_peer_certificate(handle) Constraint SSL_get_peer_certificate(handle) = {[-MAX, -1], [1, MAX]} Call SSL_get_verify_result(handle) Constraint SSL_get_verify_result(handle) = {[X509_V_OK, X509_V_OK]} cu curl Event Line SSL_get_verify_result = {[X509_V_OK, X509_V_OK]} {cu curl} Constraint Line SSL_get_peer_certificate = {[-MAX, -1], [1, MAX]} {cu curl} … …. Any constraint

  • r call

Line numbers when event is called

slide-68
SLIDE 68

Example: extract condition contexts from symbolic abstractions

68

Event Line SSL_get_verify_result = {[X509_V_OK, X509_V_OK]} {curl, ng ngin inx} Constraint Line SSL_get_peer_certificate = {[-MAX, -1], [1, MAX]} {curl, ng ngin inx} … …. Call SSL_get_verify_result(conn) Constraint SSL_get_verify_result(handle) == {[X509_V_OK, X509_V_OK]} Call SSL_get_peer_certificate(conn) Constraint SSL_get_peer_certificate(conn) != {[-MAX, -1], [1, MAX]} ng ngin inx

slide-69
SLIDE 69

Example: extract condition contexts from symbolic abstractions

69

Call SSL_get_peer_certificate(ssl) Constraint SSL_get_peer_certificate(ssl) = {[-MAX, -1], [1, MAX]} Call SSL_get_verify_result(ssl) Constraint SSL_get_verify_result(ssl) = {[X509_V_OK, X509_V_OK]} nmap nmap Event Line SSL_get_verify_result = {[X509_V_OK, X509_V_OK]} {curl, nginx, nmap nmap} Constraint Line SSL_get_peer_certificate = {[-MAX, -1], [1, MAX]} {curl, nginx, nmap nmap} … ….

slide-70
SLIDE 70

Example: extract condition contexts from symbolic abstractions

70

Call SSL_get_verify_result(ssl) Constraint SSL_get_verify_result(ssl) = {[X509_V_OK, X509_V_OK]} Call SSL_get_peer_certificate(ssl) he hexcha hat Event Line SSL_get_verify_result = {[X509_V_OK, X509_V_OK]} {curl, nginx, nmap, he hexcha hat} Constraint Line SSL_get_peer_certificate = {[-MAX, -1], [1, MAX]} {curl, nginx, nmap} … ….

slide-71
SLIDE 71

Example: find majority & minority usages from contexts

71

Event Line SSL_get_verify_result = {[X509_V_OK, X509_V_OK]} {curl, nginx, nmap, hexchat, …} Constraint Line SSL_get_peer_certificate = {[-MAX, -1], [1, MAX]} {curl, nginx, nmap, …} … ….

slide-72
SLIDE 72

Example: find majority & minority usages from contexts

72

Event Line SSL_get_verify_result = {[X509_V_OK, X509_V_OK]} {curl, nginx, nmap, hexchat, …} Constraint Line SSL_get_peer_certificate = {[-MAX, -1], [1, MAX]} {curl, nginx, nmap, …} … …. Majority uses ( Likely correct )

slide-73
SLIDE 73

Example: find majority & minority usages from contexts

73

Event Line SSL_get_verify_result = {[X509_V_OK, X509_V_OK]} {curl, nginx, nmap, hexchat, …} Constraint Line SSL_get_peer_certificate = {[-MAX, -1], [1, MAX]} {curl, nginx, nmap, …} … …. Majority uses ( Likely correct ) Deviant uses ( Likely bug)

= total_event – majority_use = {he

hexcha chat, , …} …}

slide-74
SLIDE 74

Overview of APISan

74

Return value checker Argument checker Causality checker Condition checker 4 4 Ch Checkers Source code Source code Source code APIs Arguments Constraints Symbolic execution database Relaxed Symbolic Execution

: minor, but not bug : minor and bug

…

Minority uses

...

Ranked minority uses

slide-75
SLIDE 75

False positives can be happened in majority analysis

  • Lack of inter-procedural analysis
  • e.g., check a return value of malloc() inside a function
  • Correlation ≠ Causation
  • e.g., fprintf() is used for printing debug messages when open()

is failed

  • Correct minor uses
  • e.g., strcmp() == 0, strcmp() > 0

75

slide-76
SLIDE 76

Ranking can mitigate false positives

  • More majority pattern repeated, more bug-likely
  • e.g., 999 majority, 1 minority > 10 majority, 1 minority
  • General information
  • e.g., most of allocation functions have “alloc” in their names

and are required to check their return values

  • Domain specific knowledge
  • e.g., SSL APIs start with a string “SSL”

76

slide-77
SLIDE 77

Our approach is formalized as a general framework

77

slide-78
SLIDE 78

Implementation of APISan

  • 9K LoC in total
  • Symbolic database generation : 6K LoC of C/C++ (Clang 3.6)
  • APISan library : 2K LoC of Python
  • Checkers : 1K LoC of Python
  • Return value checker : 131 LoC
  • Argument checker : 251 LoC
  • …

78

slide-79
SLIDE 79

Evaluation questions

  • How effective is APISan in finding new bugs?
  • How easy to use and easy to extend?
  • How effective is APISan’s ranking system?

79

slide-80
SLIDE 80

APISan is effective in finding bugs

  • Found 76 new bugs in large, complex software
  • Linux kernel, OpenSSL, PHP, Python, and Debian packages
  • Security implication
  • e.g., CVE-2016-5636: Python zipimporter heap overflow

(Code execution in Google App Engine)

80

slide-81
SLIDE 81

APISan is easy to use without any manual annotation

  • To generate symbolic context database

$ $ ap apis isan an ma make # use use existi ting ng bui build d comma mmand nd

  • Run a checker

$ $ ap apis isan an --

  • -ch

check cker=cp cpair # # cp cpair : causality ch check cker

  • Run a checker (inter-application)

$ap apis isan an --

  • -ch

check cker=cp cpair --

  • -db

db=a =app1, app2

81

slide-82
SLIDE 82

APISan is easy to extend

  • e.g., Integer overflow check
  • Integer overflow sensitive APIs
  • Have security implications when integer overflow happens
  • e.g., memory allocation functions
  • Integer overflow ß Arguments + Constraints
  • If arguments contains binary operators

à check integer overflow within given constraints

82

slide-83
SLIDE 83

Check integer overflow with APISan

  • Collect all integer overflows
  • Ranking strategy
  • More integer overflow prevented by constraints

à APIs are likely integer overflow sensitive

  • Incorrect constraints > Missing constraints

; Missing constraints can be caused by limited analysis

  • Found 6 integer overflows (167 LoC)

83

slide-84
SLIDE 84

APISan’s ranking system is effective

  • Linux Kernel

with Return Value Checker

  • Total 2,776 reports
  • Audited 445 reports
  • Found 54 bugs

84

slide-85
SLIDE 85

APISan’s ranking system is effective

  • Linux Kernel

with Return Value Checker

  • Total 2,776 reports
  • Audited 445 reports
  • Found 54 bugs

85

30 30 bugs in 20 20 AP APIs 24 24 bugs in 3 3 AP APIs

slide-86
SLIDE 86

APISan’s ranking system is effective

  • Linux Kernel

with Return Value Checker

  • Total 2,776 reports
  • Audited 445 reports
  • Found 54 bugs

86

30 30 bugs in 20 20 AP APIs 24 24 bugs in 3 3 AP APIs 15 bugs in 1 APIs

slide-87
SLIDE 87

Limitation

  • No soundness & No completeness
  • High false positive rate : > 80%
  • Too slow to frequently analyze
  • 32-core Xeon server with 256GB RAM
  • For Linux kernel,

Generating database : 8 hours Each checker: 6 hours

  • Not fully resolve path explosion
  • stopped in functions which have path explosion

87

slide-88
SLIDE 88

Conclusion

  • APISan: an automatic way for finding API misuse
  • Effective: Finding 76 new bugs
  • Scalable: Tested with Linux kernel, Debian packages, etc
  • APISan *WILL* be released as open source
  • https://github.com/sslab-gatech

88

slide-89
SLIDE 89

Thank you!

Questions?

89