Triggering Deep Vulnerabilities Using Symbolic Execution Dan - - PowerPoint PPT Presentation

▶
triggering deep vulnerabilities using symbolic execution
SMART_READER_LITE
LIVE PREVIEW

Triggering Deep Vulnerabilities Using Symbolic Execution Dan - - PowerPoint PPT Presentation

Mar 10, 2024 26 likes •393 views

Triggering Deep Vulnerabilities Using Symbolic Execution Dan Caselden, Alex Bazhanyuk, Mathias Payer , Stephen McCamant, Dawn Song, and many other awesome researchers, coders, and reverse engineers in the BitBlaze group at UC Berkeley *

slide-1
SLIDE 1

Triggering Deep Vulnerabilities Using Symbolic Execution

Dan Caselden, Alex Bazhanyuk, Mathias Payer, Stephen McCamant, Dawn Song, and many other awesome researchers, coders, and reverse engineers in the BitBlaze group at UC Berkeley

* images taken from original “Alice in Wonderland”

slide-2
SLIDE 2

Preconditions

Finding bugs and crashes is easy

– Fuzzing, Bounded Model Checking, test cases

Exploit generation is hard

– Trigger for vulnerability? – Input transformations?

slide-3
SLIDE 3

Setup

Program (with target condition) PoC Input

SE

slide-4
SLIDE 4

Road map

Motivation Definition and tools State explosion Scaling up Divide and conquer Binary analysis The end

slide-5
SLIDE 5

What is Symbolic Execution?

An abstract interpretation of code

– Symbolic values, not concrete

Agnostic to concrete values

– Values turn into formulas – Constraints concretize formulas

Finds concrete input

– Triggers “interesting” condition

slide-6
SLIDE 6

Using Symbolic Execution

Define set of conditions at code locations

– Symbolic Execution determines triggering input

Testing: finding bugs in applications

– Infer pre/post conditions and add assertions – Use symbolic execution to negate conditions

Exploit generation: generate PoC input

– Vulnerability condition is predefined

slide-7
SLIDE 7

Symbolic Execution Tools

FuzzBALL

– PoC exploits for given vulnerability conditions – http://bitblaze.cs.berkeley.edu/fuzzball.html

S2E: Selective Symbolic Execution

– Automatic testing of binary code – http://dslab.epfl.ch/proj/s2e

KLEE

– Bug finding in source code – http://ccadar.github.io/klee/

slide-8
SLIDE 8

Example #1: Vortex Wargame*

* http://www.overthewire.org/wargames/

#include <...> void print(unsigned char *buf, int len); // print state (for debugging) #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000) { win(); } int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case '\n': print(buf, sizeof(buf)); continue; break; case '\\': ptr--; break; default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; } } }

slide-9
SLIDE 9

Example #1: Vortex Wargame*

* http://www.overthewire.org/wargames/

#include <...> void print(unsigned char *buf, int len); // print state (for debugging) #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000){win();} int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case '\n': print(buf, sizeof(buf)); continue; break; case '\\': ptr--; break; default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; } } } #include <...> void print(unsigned char *buf, int len); // print state (for debugging) #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000){win();} int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case '\n': print(buf, sizeof(buf)); continue; break; case '\\': ptr--; break; default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; } } }

slide-10
SLIDE 10

Example #1: Vortex Wargame*

* http://www.overthewire.org/wargames/

#include <...> void print(unsigned char *buf, int len); // print state (for debugging) #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000){win();} int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case '\n': print(buf, sizeof(buf)); continue; break; case '\\': ptr--; break; default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; } } } #include <...> void print(unsigned char *buf, int len); // print state (for debugging) #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000){win();} int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case '\n': print(buf, sizeof(buf)); continue; break; case '\\': ptr--; break; default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; } } }

slide-11
SLIDE 11

Example #1: Vortex Wargame*

* http://www.overthewire.org/wargames/

#include <...> void print(unsigned char *buf, int len); // print state (for debugging) #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000){win();} int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case '\n': print(buf, sizeof(buf)); continue; break; case '\\': ptr--; break; default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; } } } #include <...> void print(unsigned char *buf, int len); // print state (for debugging) #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000){win();} int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case '\n': print(buf, sizeof(buf)); continue; break; case '\\': ptr--; break; default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; } } }

slide-12
SLIDE 12

Example #1: Vortex Wargame*

* http://www.overthewire.org/wargames/

#include <...> void print(unsigned char *buf, int len); // print state (for debugging) #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000){win();} int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case '\n': print(buf, sizeof(buf)); continue; break; case '\\': ptr--; break; default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; } } } #include <...> void print(unsigned char *buf, int len); // print state (for debugging) #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000){win();} int main() { unsigned char buf[512]; unsigned char *ptr = buf + (sizeof(buf)/2); unsigned int x; while((x = getchar()) != EOF) { switch(x) { case '\n': print(buf, sizeof(buf)); continue; break; case '\\': ptr--; break; default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; } } }

slide-13
SLIDE 13

Example #1: Vortex Wargame*

switch (input) {

case '\n': debug() // print debug information case '\': ptr--; // decrement ptr default: if (ptr & 0xff000000 == 0xca000000) win(); if (ptr < buf[len]) ptr++[0] = input;

}

* http://www.overthewire.org/wargames/

buf[512] ptr

Demo! Problem size: 3n

slide-14
SLIDE 14

Road map

Motivation Definition and tools State explosion Scaling up Divide and conquer Binary analysis The end

slide-15
SLIDE 15

Does Symbolic Exec. scale?

Run Length Encoding: compression

– Decode and expand input string – Output buffer is given – Symbolic Execution produces input – Different input/output length

Evaluate performance of

– KLEE – FuzzBALL

slide-16
SLIDE 16

RLE-1 In: 3 Out: 3 RLE-2 In: 3 Out: 4 RLE-3 In: 3 Out: 6 RLE-4 In: 4 Out: 2 RLE-5 In: 5 Out: 3 RLE-6 In: 5 Out: 6 RLE-7 In: 5 Out: 7 RLE-8 In: 5 Out: 12 RLE-9 In: 7 Out: 9 1 10 100 1000 10000 100000 KLEE FuzzBALL

RLE encoding: limitations*

* Detailed results from TR Berkeley/EECS-2013-125

Vanilla Symbolic Execution does NOT scale!

slide-17
SLIDE 17

State explosion

At each decision point

– Number of paths doubles (fork) – Updated or added constraints

1 2 3 4 5 6 1 1, 6 1, 2 1, 2, 3, 5, 1 1, 2, 4, 5, 1 1, 2, 3, 5, 1, 6 1, 2, 3, 5, 1, 2 1, 2, 4, 5, 1, 6 1, 2, 4, 5, 1, 2

slide-18
SLIDE 18

Reasons for state explosion

Too much input/output data

– Not much we can do about

Too much included state

– Limit symbolic state

Too much executed code

– Divide and conquer

slide-19
SLIDE 19

Road map

Motivation Definition and tools State explosion Scaling up Divide and conquer Binary analysis The end

slide-20
SLIDE 20

Interesting input sizes

<10 symbolic bytes

– Address, offset or pointer

20-80 symbolic bytes

– Shellcode, ROP chain

>200 symbolic bytes

– Shellcode plus data, long ROP chains – Complete data structures

slide-21
SLIDE 21

Heuristics to the rescue

Assume properties for transformations

– Surjectivity: there exists a pre-image – Sequentiality: output is never revoked – Streaming: bounded transformation state

Encoded heuristics

– Prune early, prune often if target unreachable – Be greedy, prioritize paths that maximize output – Optimize array accesses

slide-22
SLIDE 22

RLE encoding: heuristics*

RLE-1 In: 3 Out: 3 RLE-2 In: 3 Out: 4 RLE-3 In: 3 Out: 6 RLE-4 In: 4 Out: 2 RLE-5 In: 5 Out: 3 RLE-6 In: 5 Out: 6 RLE-7 In: 5 Out: 7 RLE-8 In: 5 Out: 12 RLE-9 In: 7 Out: 9 1 10 100 1000 10000 100000 KLEE FuzzBALL FuzzBALL-heuristic

* Detailed results from TR Berkeley/EECS-2013-125

Heuristics help. Heuristics help. A little. Heuristics help. A little. State explosion remains!

slide-23
SLIDE 23

Road map

Motivation Definition and tools State explosion Scaling up Divide and conquer Binary analysis The end

slide-24
SLIDE 24

Divide and conquer

Program (with target condition)

SE

Input buf0 buf1 buf2

trans. trans. trans.

SE SE SE

PoC Input

slide-25
SLIDE 25

Does Symbolic Exec. scale?

Hex and Run Length Decoding

– Two transformations, e.g.,

FB41014280 → \xfbA\x01B\x80 \xfbA\x01B\x80 → AAAAAAB

– We know all buffer locations

Evaluate performance of

– KLEE/FuzzBALL – FuzzBALL with heuristics – FuzzBALL with two iterations

slide-26
SLIDE 26

Example #2: HEX & RLE

ASCIIHexDecode(buf0, len0, buf1, 4096); if (RunLengthDecode(buf1, len1, buf2, 4096) != -1) { if (strncmp(argv[3], (char*)buf2, strlen(argv[3])) == 0) { printf("Correctly recovered str\n"); } } HEXDecode RLEDecode Input

SE SE

buf0 buf1 buf2

Demo!

slide-27
SLIDE 27

HEXRLE encoding: iterations

HEXRLE-1 In: 10 Inter: 5 Out: 12 HEXRLE-2 In: 14 Inter: 7 Out: 9 HEXRLE-3 In: 16 Inter: 8 Out: 10 HEXRLE-4 In: 18 Inter: 9 Out: 11 HEXRLE-5 In: 125 Inter: 60 Out: 57 HEXRLE-5 In: 125 Inter: 60 Out: 57 HEXRLE-6 In: 250 Inter: 120 Out: 114 1 10 100 1000 10000 100000 KLEE / FuzzBALL FuzzBALL-heuristics FuzzBALL-HI-CFG Runtime [s] 10hr timeout

slide-28
SLIDE 28

One problem solved...

Divide and conquer mitigates scaling issues We now have two new problems:

– Finding transformation

boundaries

– Finding buffers locations

slide-29
SLIDE 29

Road map

Motivation Definition and tools State explosion Scaling up Divide and conquer Binary analysis The end

slide-30
SLIDE 30

Hybrid Info. and Control-Flow Graph

1 2 3 4 5 6

Buffer A Buffer C Buffer B

Control-Flow Graph Information-Flow Graph

slide-31
SLIDE 31

Trace-based binary analysis

Trace allows to recover both (live) control-flow and information-flow using concrete input

  • 1. Start with concrete input
  • 2. Collect instruction-level trace
  • 3. Process trace offline to discover buffers
slide-32
SLIDE 32

Grouping memory accesses

“Related” accesses target same buffer

– Temporal relation – Spatial relation

Assume a buffer hierarchy

– Layers of buffers

Find “natural” boundaries between transformations

slide-33
SLIDE 33

Example #3: CVE-2010-3704

Type 1 font parsing bug in Poppler PDF-viewer

I/O Flate decode Read Font Parse Font

slide-34
SLIDE 34

Example #3: Poppler buffers

space bf792000 4096 alloc 828b420 312 alloc 829f008 34104 alloc 82b7550 9887 memcpy GfxFont::readEmbed FontFile(Xref*, int*) FlateStream::getHuffmanCode Word(FlateHuffmanTab*) FoFiType1: :parse() (implicit)

“Automatically” produce input that triggers vulnerability

slide-35
SLIDE 35

Road map

Motivation Definition and tools State explosion Scaling up Divide and conquer Binary analysis The end

slide-36
SLIDE 36

The end

Symbolic Execution is

– No panacea – A great tool for PoCs

Trigger conditions deep in the program

– Construct PoC input

Explore how deep the rabbit hole goes!

– http://bitblaze.cs.berkeley.edu – http://nebelwelt.net