Paper Info
Title
Uncovering Use-After-Free Conditions in Compiled Code
Abstract
Use-after-free conditions occur when an execution path of a process accesses an incorrectly deal located object. Such access is problematic because it may potentially allow for the execution of arbitrary code by an adversary. However, while increasingly common, such flaws are rarely detected by compilers in even the most obvious instances. In this paper, we design and implement a static analysis method for the detection of use-after-free conditions in binary code. Our new analysis is similar to available expression analysis and traverses all code paths to ensure that every object is defined before each use. Failure to achieve this property indicates that an object is improperly freed and potentially vulnerable to compromise. After discussing the details of our algorithm, we implement a tool and run it against a set of enterprise-grade, publicly available binaries. We show that our tool can not only catch textbook and recently released in-situ examples of this flaw, but that it has also identified 127 additional use-after-free conditions in a search of 652 compiled binaries in the Windows system32 directory. In so doing, we demonstrate not only the power of this approach in combating this increasingly common vulnerability, but also the ability to identify such problems in software for which the source code is not necessarily publicly available.
Year
DOI
Venue
2015
10.1109/ARES.2015.61
International Conference on availability, reliability and security
Keywords
Field
DocType
Software Security,Static Analysis,Binary Decompilation
Object code,Static program analysis,Computer security,Source code,Computer science,Redundant code,Compiled language,Compiler,KPI-driven code analysis,Dead code
Conference
Citations 
PageRank 
References 
2
0.37
18
Authors
3
Name
Order
Citations
PageRank
David Dewey1151.39
Bradley Reaves226822.81
Patrick Traynor3117187.80