Skip to main content
SpringerLink
Log in

MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels

  • Regular Paper
  • Published:
Journal of Computer Science and Technology Aims and scope Submit manuscript

Abstract

Allocation, dereferencing, and freeing of memory data in kernels are coherently linked. There widely exist real cases where the correctness of memory is compromised. This incorrectness in kernel memory brings about significant security issues, e.g., information leaking. Though memory allocation, dereferencing, and freeing are closely related, previous work failed to realize they are closely related. In this paper, we study the life-cycle of kernel memory, which consists of allocation, dereferencing, and freeing. Errors in them are called memory life-cycle (MLC) bugs. We propose an in-depth study of MLC bugs and implement a memory life-cycle bug sanitizer (MEBS) for MLC bug detection. Utilizing an inter-procedural global call graph and novel identification approaches, MEBS can reveal memory allocation, dereferencing, and freeing sites in kernels. By constructing a modified define-use chain and examining the errors in the life-cycle, MLC bugs can be identified. Moreover, the experimental results on the latest kernels demonstrate that MEBS can effectively detect MLC bugs, and MEBS can be scaled to different kernels. More than 100 new bugs are exposed in Linux and FreeBSD, and 12 common vulnerabilities and exposures (CVE) are assigned.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Similar content being viewed by others

References

  1. Akritidis P, Cadar C, Raiciu C, Costa M, Castro M. Preventing memory error exploits with WIT. In Proc. the 2008 IEEE Symposium on Security and Privacy, May 2008, pp.263-277. https://doi.org/10.1109/SP.2008.30.

  2. Lee B, Song C, Kim T, Lee W. Type casting verification: Stopping an emerging attack vector. In Proc. the 24th USENIX Security Symposium, Aug. 2015, pp.81-96.

  3. Szekeres L, Payer M, Wei T, Song D. SoK: Eternal war in memory. In Proc. the 2013 IEEE Symposium on Security and Privacy, May 2013, pp.48-62. https://doi.org/10.1109/SP.2013.13.

  4. Xu J, Mu D, Chen P, Xing X, Wang P, Liu P. CREDAL: Towards locating a memory corruption vulnerability with your core dump. In Proc. the 2016 ACM SIGSAC Conference on Computer and Communications Security, Oct. 2016, pp.529-540. https://doi.org/10.1145/2976749.2978340.

  5. Zhang G. Detecting memory life-cycle bugs with extended define-use chain analysis. IEEE Access, 2020, 8: 114968-114980. https://doi.org/10.1109/ACCESS.2020.2999351.

    Article  Google Scholar 

  6. He B, Rastogi V, Cao Y, Chen Y, Venkatakrishnan V N, Yang R, Zhang Z. Vetting SSL usage in applications with SSLINT. In Proc. the 2015 IEEE Symposium on Security and Privacy, May 2015, pp.519-534. https://doi.org/10.1109/SP.2015.38.

  7. Yamaguchi F, Golde N, Arp D, Rieck K. Modeling and discovering vulnerabilities with code property graphs. In Proc. the 2014 IEEE Symposium on Security and Privacy, May 2014, pp.590-604. https://doi.org/10.1109/SP.2014.44.

  8. Chen H, Wagner D. MOPS: An infrastructure for examining security properties of software. In Proc. the 9th ACM Conference on Computer and Communications Security, Nov. 2002, pp.235-244. https://doi.org/10.1145/586110.586142.

  9. Yun I, Min C, Si X, Jang Y, Kim T, Naik M. APISan: Sanitizing API usages through semantic cross-checking. In Proc. the 25th USENIX Security Symposium, Aug. 2016, pp.363-378.

  10. Son S, McKinley K S, Shmatikov V. RoleCast: Finding missing security checks when you do not know what checks are. In Proc. the 2011 ACM International Conference on Object Oriented Programming Systems Languages and Applications, Oct. 2011, pp.1069-1084. https://doi.org/10.1145/2048066.2048146.

  11. Yamaguchi F, Wressnegger C, Gascon H, Rieck K. Chucky: Exposing missing checks in source code for vulnerability discovery. In Proc. the 2013 ACM SIGSAC Conference on Computer and Communications Security, Nov. 2013, pp.499-510. https://doi.org/10.1145/2508859.2516665.

  12. Lu K, Pakki A, Wu Q. Detecting missing-check bugs via semantic- and context-aware criticalness and constraints inferences. In Proc. the 28th USENIX Security Symposium, Aug. 2019, pp.1769-1786.

  13. Engler D, Chelf B, Chou A, Hallem S. Checking system rules using system-specific, programmer-written compiler extensions. In Proc. the 4th Symposium on Operating System Design and Implementation, Oct. 2000, pp.1-16.

  14. Engler D, Chen D Y, Hallem S, Chou A, Chelf B. Bugs as deviant behavior: A general approach to inferring errors in systems code. ACM SIGOPS Operating Systems Review, 2001, 35(5): 57-72. https://doi.org/10.1145/502059.502041.

    Article  Google Scholar 

  15. Brown F, Nötzli A, Engler D. How to build static checking systems using orders of magnitude less code. In Proc. the 21st International Conference on Architectural Support for Programming Languages and Operating Systems, April 2016, pp.143-157. https://doi.org/10.1145/2872362.2872364.

  16. Lu K, Pakki A, Wu Q. Automatically identifying security checks for detecting kernel semantic bugs. In Proc. the 2019 European Symposium on Research in Computer Security, Sept. 2019, pp.3-25. https://doi.org/10.1007/978-3-030-29962-0_1.

  17. Xu M, Qian C, Lu K, Backes M, Kim T. Precise and scalable detection of double-fetch bugs in OS kernels. In Proc. the 2018 IEEE Symposium on Security and Privacy, May 2018, pp.661-678. https://doi.org/10.1109/SP.2018.00017.

  18. Wang W, Lu K, Yew P C. Check it again: Detecting lacking-recheck bugs in OS kernels. In Proc. the 2018 ACM SIGSAC Conference on Computer and Communications Security, Oct. 2018, pp.1899-1913. https://doi.org/10.1145/3243734.3243844.

  19. Zhang T, Shen W, Lee D, Jung C, Azab A M, Wang R. PeX: A permission check analysis framework for Linux kernel. In Proc. the 28th USENIX Security Symposium, Aug. 2019, pp.1205-1220.

  20. Gens D, Schmitt S, Davi L, Sadeghi A R. K-Miner: Uncovering memory corruption in Linux. In Proc. the 2018 Network and Distributed System Security Symposium, Feb. 2018. https://doi.org/10.14722/NDSS.2018.23326.

  21. Yan H, Sui Y, Chen S, Xue J. Machine-learning-guided typestate analysis for static use-after-free detection. In Proc. the 33rd Annual Computer Security Applications Conference, Dec. 2017, pp.42-54. https://doi.org/10.1145/3134600.3134620.

  22. Wang H, Xie X, Li Y, Wen C, Li Y, Liu Y, Sui Y. Typestate-guided fuzzer for discovering use-after-free vulnerabilities. In Proc. the 42nd IEEE/ACM International Conference on Software Engineering, July 2020, pp.999-1010. https://doi.org/10.1145/3377811.3380386.

  23. Gao Q, Zhang W, Chen Z, Zheng M, Qin F. 2ndStrike: Toward manifesting hidden concurrency typestate bugs. ACM SIGPLAN Notices, 2011, 46(3): 239-250. https://doi.org/10.1145/1961296.1950394.

    Article  Google Scholar 

  24. Marriott K, Stuckey P J, Sulzmann M. Resource usage verification. In Proc. the 1st Asian Symposium on Programming Languages and Systems, Nov. 2003, pp.212-229. https://doi.org/10.1007/978-3-540-40018-9_15.

  25. Xu Z, Wen C, Qin S. State-taint analysis for detecting resource bugs. Science of Computer Programming, 2018, 162: 93-109. https://doi.org/10.1016/j.scico.2017.06.010.

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. College of Computer Science and Technology, National University of Defense Technology, Changsha, 410073, China

    Gen Zhang, Peng-Fei Wang, Tai Yue, Xu Zhou & Kai Lu

Authors
  1. Gen Zhang
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Peng-Fei Wang
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Tai Yue
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Xu Zhou
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Kai Lu
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Gen Zhang.

Supplementary Information

ESM 1

(PDF 151 kb)

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Zhang, G., Wang, PF., Yue, T. et al. MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels. J. Comput. Sci. Technol. 36, 1248–1268 (2021). https://doi.org/10.1007/s11390-021-1593-4

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11390-021-1593-4

Keywords

Search

Navigation