Finding user/kernel pointer bugs with type inference

The basic type-inference capabilities of C QUAL are extended to support context-sensitivity and greater precision when analyzing structures so that CQUAL requires fewer annotations and generates fewer false positives.

Abstract

Abstract Today's operating systems struggle with vulnerabil-ities from careless handling of user space pointers. User/kernel pointer bugs have serious consequences forsecurity: a malicious user could exploit a user/kernel pointer bug to gain elevated privileges, read sensitivedata, or crash the system. We show how to detect user/kernel pointer bugs using type-qualifier inference,and we apply this method to the Linux kernel using CQUAL, a type-qualifier inference tool. We extend thebasic type-inference capabilities of CQ UAL to supportcontext-sensitivity and greater precision when analyzing structures so that CQUAL requires fewer annota-tions and generates fewer false positives. With these enhancements, we were able to use CQUAL to find 17exploitable user/kernel pointer bugs in the Linux kernel. Several of the bugs we found were missed by carefulhand audits, other program analysis tools, or both. 1 Introduction Security critical programs must handle data from un-trusted sources, and mishandling of this data can lead to security vulnerabilities. Safe data-management is par-ticularly crucial in operating systems, where a single bug can expose the entire system to attack. Pointers passedas arguments to system calls are a common type of untrusted data in OS kernels and have been the cause ofmany security vulnerabilities. Such user pointers occur in many system calls, including, for example, read, write, ioctl, and statfs. These user pointers mustbe handled very carefully: since the user program and