skip to main content
10.1145/3319535.3345654acmconferencesArticle/Chapter ViewAbstractPublication PagesccsConference Proceedingsconference-collections
research-article

Different is Good: Detecting the Use of Uninitialized Variables through Differential Replay

Published: 06 November 2019 Publication History

Abstract

The use of uninitialized variables is a common issue. It could cause kernel information leak, which defeats the widely deployed security defense, i.e., kernel address space layout randomization (KASLR). Though a recent system called Bochspwn Reloaded reported multiple memory leaks in Windows kernels, how to effectively detect this issue is still largely behind.
In this paper, we propose a new technique, i.e., differential replay, that could effectively detect the use of uninitialized variables. Specifically, it records and replays a program's execution in multiple instances. One instance is with the vanilla memory, the other one changes (or poisons) values of variables allocated from the stack and the heap. Then it compares program states to find references to uninitialized variables. The idea is that if a variable is properly initialized, it will overwrite the poisoned value and program states in two running instances should be the same. After detecting the differences, our system leverages the symbolic taint analysis to further identify the location where the variable was allocated. This helps us to identify the root cause and facilitate the development of real exploits. We have implemented a prototype called TimePlayer. After applying it to both Windows 7 and Windows 10 kernels (x86/x64), it successfully identified 34 new issues and another 85 ones that had been patched (some of them were publicly unknown.) Among 34 new issues, 17 of them have been confirmed as zero-day vulnerabilities by Microsoft.

Supplementary Material

WEBM File (p1883-qu.webm)

References

[1]
George Argyros, Ioannis Stais, Suman Jana, Angelos D Keromytis, and Aggelos Kiayias. 2016. SFADiff: Automated Evasion Attacks and Fingerprinting Using Black-box Differential Automata Learning. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security.
[2]
Amittai Aviram, Shu-Chun Weng, Sen Hu, and Bryan Ford. 2012. Efficient System-enforced Deterministic Parallelism. Commun. ACM (2012).
[3]
Fabrice Bellard. 2005. QEMU, a Fast and Portable Dynamic Translator. In Proceedings of the 2005 USENIX Conference on Usenix Annual Technical Conference.
[4]
Tom Bergan, Nicholas Hunt, Luis Ceze, and Steven D Gribble. 2010. Deterministic Process Groups in dOS. In Proceedings of the 9th USENIX conference on Operating systems design and implementation.
[5]
Emery D Berger and Benjamin G Zorn. 2006. DieHard: Probabilistic Memory Safety for Unsafe Languages. In Proceedings of the 27th ACM SIGPLAN Conference on Programming Language Design and Implementation.
[6]
Chad Brubaker, Suman Jana, Baishakhi Ray, Sarfraz Khurshid, and Vitaly Shmatikov. 2014. Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations. In Proceedings of the 2014 IEEE Symposium on Security and Privacy.
[7]
Derek Bruening and Qin Zhao. 2011. Practical Memory Checking with Dr. Memory. In Proceedings of the 9th Annual IEEE/ACM International Symposium on Code Generation and Optimization.
[8]
Yuting Chen, Ting Su, Chengnian Sun, Zhendong Su, and Jianjun Zhao. 2016. Coverage-directed Differential Testing of JVM Implementations. In Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation.
[9]
Yuting Chen and Zhendong Su. 2015. Guided Differential Testing of Certificate Validation in SSL/TLS Implementations. In Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering.
[10]
Winnie Cheng, Qin Zhao, Bei Yu, and Scott Hiroshige. 2006. Tainttrace: Efficient Flow Tracing with Dynamic Binary Rewriting. In Proceedings of the 11th IEEE Symposium on Computers and Communications.
[11]
Baojiang Cui, Fuwei Wang, Tao Guo, Guowei Dong, and Bing Zhao. 2013. FlowWalker: A Fast and Precise Off-Line Taint Analysis Framework. In Proceedings of the 2013 Fourth International Conference on Emerging Intelligent Data and Web Technologies.
[12]
Baojiang Cui, Fuwei Wang, Yongle Hao, and Xiaofeng Chen. 2017. WhirlingFuzzwork: a Taint-analysis-based API in-memory Fuzzing Framework. In Joural of Soft Computing.
[13]
Baojiang Cui, Fuwei Wang, Yongle Hao, and Lingyu Wang. 2016. A Taint Based Approach for Automatic Reverse Engineering of Gray-box File Formats. In Joural of Soft Computing.
[14]
Brendan Dolan-Gavitt, Josh Hodosh, Patrick Hulin, Tim Leek, and Ryan Whelan. 2015. Repeatable Reverse Engineering with PANDA. In Proceedings of the 5th Program Protection and Reverse Engineering Workshop.
[15]
George W Dunlap, Samuel T King, Sukru Cinar, Murtaza A Basrai, and Peter M Chen. 2002. ReVirt: Enabling Intrusion Analysis through Virtual-machine Logging and Replay. ACM SIGOPS Operating Systems Review (2002).
[16]
George W Dunlap, Dominic G Lucchetti, Michael A Fetterman, and Peter M Chen. 2008. Execution Replay of Multiprocessor Virtual Machines. In Proceedings of the 4th ACM SIGPLAN/SIGOPS international conference on Virtual execution environments.
[17]
William Enck, Peter Gilbert, Seungyeop Han, Vasant Tendulkar, Byung-Gon Chun, Landon P Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N Sheth. 2014. TaintDroid: an Information-flow Tracking System for Realtime Privacy Monitoring on Smartphones. In ACM Transactions on Computer Systems (TOCS).
[18]
Derek R Hower and Mark D Hill. 2008. Rerun: Exploiting Episodes for Lightweight Memory Race Recording. In ACM SIGARCH computer architecture news.
[19]
Intel. 2018. Intel XED. https://intelxed.github.io
[20]
Francc ois Irigoin, Pierre Jouvelot, and Rémi Triolet. 2014. Semantical Interprocedural Parallelization: An overview of the PIPS project. In ACM International Conference on Supercomputing 25th Anniversary Volume.
[21]
Anushri Jana and Ravindra Naik. 2012. Precise Detection of Uninitialized Variables Using Dynamic Analysis-Extending to Aggregate and Vector Types. In Proceedings of the 19th Working Conference on Reverse Engineering.
[22]
Suman Jana and Vitaly Shmatikov. 2012. Abusing File Processing in Malware Detectors for Fun and Profit. In Proceedings of the 2012 IEEE Symposium on Security and Privacy.
[23]
Rahul Jiresal, Adnan Contractor, and Ravindra Naik. 2011. Precise Detection of Un-initialized Variables in Large, Real-life COBOL Programs in Presence of Unrealizable Paths. (2011).
[24]
Mateusz Jurczyk. 2017. Detecting Kernel Memory Disclosure with x86 Emulation and Taint Tracking. (2017).
[25]
Timotej Kapus and Cristian Cadar. 2017. Automatic Testing of Symbolic Execution Engines via Program Generation and Differential Testing. In Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering.
[26]
Wei Ming Khoo. 2018. Taintgrind: a Valgrind Taint Analysis Tool.
[27]
Oren Laadan, Nicolas Viennot, and Jason Nieh. 2010. Transparent, Lightweight Application Execution Replay on Commodity Multiprocessor Operating Systems. In ACM SIGMETRICS performance evaluation review.
[28]
Chris Lattner. 2018. Clang: a C language Family Frontend for LLVM. http://clang.llvm.org/index.html
[29]
Yutao Liu, Tianyu Zhou, Kexin Chen, Haibo Chen, and Yubin Xia. 2015. Thwarting Memory Disclosure with Efficient Hypervisor-enforced Intra-domain Isolation. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security.
[30]
Kangjie Lu, Chengyu Song, Taesoo Kim, and Wenke Lee. 2016. UniSan: Proactive Kernel Memory Initialization to Eliminate Data Leakages. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security.
[31]
Kangjie Lu, Marie-Therese Walter, David Pfaff, Stefan Nürnberger, Wenke Lee, and Michael Backes. 2017. Unleashing Use-before-initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying. In Proceedings of the 2017 Annual Network and Distributed System Security Symposium (NDSS).
[32]
Chi-Keung Luk, Robert Cohn, Robert Muth, Harish Patil, Artur Klauser, Geoff Lowney, Steven Wallace, Vijay Janapa Reddi, and Kim Hazelwood. 2005. Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation. In Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation.
[33]
Manuel López-Ibáñez. 2007. Better Uninitialized Warnings. http://gcc.gnu.org/wiki/Better Uninitialized Warnings
[34]
William M McKeeman. 1998. Differential Testing for Software. Digital Technical Journal (1998).
[35]
Microsoft. 2018. Visual Studio.
[36]
Alyssa Milburn, Herbert Bos, and Cristiano Giuffrida. 2017. Safeinit: Comprehensive and Practical Mitigation of Uninitialized Read Vulnerabilities. In Proceedings of the 2017 Annual Network and Distributed System Security Symposium.
[37]
Jiang Ming, Dinghao Wu, Jun Wang, Gaoyao Xiao, and Peng Liu. 2016. StraightTaint: Decoupled Offline Symbolic Taint Analysis. In Proceedings of the 31st IEEE/ACM International Conference on Automated Software Engineering.
[38]
Jiang Ming, Dinghao Wu, Gaoyao Xiao, Jun Wang, and Peng Liu. 2015. TaintPipe: Pipelined Symbolic Taint Analysis. In Proceedings of the 24th USENIX Security Symposium.
[39]
Pablo Montesinos, Luis Ceze, and Josep Torrellas. 2008. Delorean: Recording and Deterministically Replaying Shared-memory Multiprocessor Execution Efficiently. In ACM SIGARCH Computer Architecture News.
[40]
Satish Narayanasamy, Cristiano Pereira, and Brad Calder. 2006. Recording Shared Memory Dependencies using Strata. ACM SIGARCH Computer Architecture News (2006).
[41]
Nicholas Nethercote and Julian Seward. 2007. Valgrind: a Framework for Heavyweight Dynamic Binary Instrumentation. In Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation.
[42]
James Newsome and Dawn Song. 2005. Dynamic Taint Analysis: Automatic Detection, Analysis, and Signature Generation of Exploit Attacks on Commodity Software. In Proceedings of the 12th Network and Distributed Systems Security Symposium.
[43]
Robert O'Callahan, Chris Jones, Nathan Froyd, Kyle Huey, Albert Noll, and Nimrod Partush. 2017. Engineering Record and Replay for Deployability. In Proceedings of the 2017 USENIX Conference on Usenix Annual Technical Conference.
[44]
Jianfeng Pan, Guanglu Yan, and Xiaocao Fan. 2017. Digtool: A virtualization-based Framework for Detecting Kernel Vulnerabilities. In Proceedings of the 26th USENIX Security Symposium.
[45]
Theofilos Petsios, Adrian Tang, Salvatore Stolfo, Angelos D Keromytis, and Suman Jana. 2017. Nezha: Efficient Domain-independent Differential Testing. In Proceedings of the 2017 IEEE Symposium on Security and Privacy.
[46]
Gilles Pokam, Klaus Danne, Cristiano Pereira, Rolf Kassa, Tim Kranich, Shiliang Hu, Justin Gottschlich, Nima Honarmand, Nathan Dautenhahn, Samuel T King, et al. 2013. QuickRec: Prototyping an Intel Architecture Extension for Record and Replay of Multithreaded Programs. ACM SIGARCH Computer Architecture News (2013).
[47]
Nguyen Anh Quynh. 2014. Capstone: The Ultimate Disassembler.
[48]
John Regehr, Yang Chen, Pascal Cuoq, Eric Eide, Chucky Ellison, and Xuejun Yang. 2012. Test-case Reduction for C Compiler Bugs. In Proceedings of the 33rd ACM SIGPLAN Conference on Programming Language Design and Implementation.
[49]
Prof. John Regehr. 2011. Uninitialized Variables. http://blog.regehr.org/archives/519
[50]
Michiel Ronsse and Koen De Bosschere. 1999. RecPlay: a Fully Integrated Practical Record/replay System. ACM Transactions on Computer Systems (TOCS) (1999).
[51]
Yasushi Saito. 2005. Jockey: a User-space Library for Record-replay Debugging. In Proceedings of the 6th international symposium on Automated analysis-driven debugging.
[52]
Sergej Schumilo, Cornelius Aschermann, Robert Gawlik, Sebastian Schinzel, and Thorsten Holz. 2017. KAFL: Hardware-assisted Feedback Fuzzing for OS Kernels. In Proceedings of the 26th USENIX Security Symposium.
[53]
Edward J. Schwartz, Thanassis Avgerinos, and David Brumley. 2010. All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution (but might have been afraid to ask). In Proceedings of the 2010 IEEE Symposium on Security and Privacy.
[54]
Julian Seward and Nicholas Nethercote. 2005. Using Valgrind to Detect Undefined Value Errors with Bit-Precision. In Proceedings of the annual conference on USENIX Annual Technical Conference.
[55]
Yan Shoshitaishvili, Ruoyu Wang, Christophe Hauser, Christopher Kruegel, and Giovanni Vigna. 2015. Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware. In Proceedings of the 22nd Annual Network and Distributed System Security Symposium.
[56]
Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D Keromytis, and Suman Jana. 2017. HVLearn: Automated Black-box Analysis of Hostname Verification in SSL/TLS Implementations. In Proceedings of the 2017 IEEE Symposium on Security and Privacy.
[57]
Varun Srivastava, Michael D Bond, Kathryn S McKinley, and Vitaly Shmatikov. 2011. A Security Policy Oracle: Detecting Security Holes Using Multiple API Implementations. In Proceedings of the 32nd ACM SIGPLAN Conference on Programming Language Design and Implementation.
[58]
Evgeniy Stepanov and Konstantin Serebryany. 2015. MemorySanitizer: Fast Detector of Uninitialized Memory Use in C
[59]
. In Proceedings of the 13th Annual IEEE/ACM International Symposium on Code Generation and Optimization.
[60]
Xiajing Wang, Rui Ma, Bowen Dou, Zefeng Jian, and Hongzhou Chen. 2018. OFFDTAN: A New Approach of Offline Dynamic Taint Analysis for Binaries. In Joural of Security and Communication Networks.
[61]
Min Xu, Rastislav Bodik, and Mark D Hill. 2003. A Flight Data Recorder for Enabling Full-system Multiprocessor Deterministic Replay. In ACM SIGARCH Computer Architecture News.
[62]
Xuejun Yang, Yang Chen, Eric Eide, and John Regehr. 2011. Finding and Understanding Bugs in C Compilers. In Proceedings of the 32nd ACM SIGPLAN Conference on Programming Language Design and Implementation.
[63]
Ding Ye, Yulei Sui, and Jingling Xue. 2014. Accelerating Dynamic Detection of Uses of Undefined Values with Static Value-flow Analysis. In Proceedings of Annual IEEE/ACM International Symposium on Code Generation and Optimization.
[64]
Heng Yin and Dawn Song. 2010. Temu: Binary Code Analysis via Whole-system Layered Annotative Execution. EECS Department, University of California, Berkeley, Tech. Rep. UCB/EECS-2010--3 (2010).
[65]
Heng Yin, Dawn Song, Manuel Egele, Christopher Kruegel, and Engin Kirda. 2007. Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis. In Proceedings of the 14th ACM conference on Computer and communications security.
[66]
Michal Zalewski. 2018. American Fuzzy Lop: a Security-oriented Fuzzer. http://lcamtuf.coredump.cx/afl/
[67]
Sebastian Österlund, Koen Koning, Pierre Olivier, Antonio Barbalace, Herbert Bos, and Cristiano Giuffrida. 2019. kMVX: Detecting Kernel Information Leaks with Multi-variant Execution. In Proceedings of the 24th ACM International Conference on Architectural Support for Programming Languages and Operating Systems.

Cited By

View all
  • (2024)sMVX: Multi-Variant Execution on Selected Code PathsProceedings of the 25th International Middleware Conference10.1145/3652892.3654794(62-73)Online publication date: 2-Dec-2024
  • (2023)BoKASANProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620516(4985-5002)Online publication date: 9-Aug-2023
  • (2023)Go or No Go: Differential Fuzzing of Native and C Libraries2023 IEEE Security and Privacy Workshops (SPW)10.1109/SPW59333.2023.00036(349-363)Online publication date: May-2023
  • Show More Cited By

Index Terms

  1. Different is Good: Detecting the Use of Uninitialized Variables through Differential Replay

      Recommendations

      Comments

      Information & Contributors

      Information

      Published In

      cover image ACM Conferences
      CCS '19: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security
      November 2019
      2755 pages
      ISBN:9781450367479
      DOI:10.1145/3319535
      Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

      Sponsors

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      Published: 06 November 2019

      Permissions

      Request permissions for this article.

      Check for updates

      Author Tags

      1. differential replay
      2. kernel information leaks
      3. symbolic taint analysis
      4. uninitialized variables

      Qualifiers

      • Research-article

      Funding Sources

      • Fundamental Research Funds for the Central Universities
      • National Natural Science Foundation of China

      Conference

      CCS '19
      Sponsor:

      Acceptance Rates

      CCS '19 Paper Acceptance Rate 149 of 934 submissions, 16%;
      Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

      Upcoming Conference

      CCS '25

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • Downloads (Last 12 months)63
      • Downloads (Last 6 weeks)4
      Reflects downloads up to 08 Mar 2025

      Other Metrics

      Citations

      Cited By

      View all
      • (2024)sMVX: Multi-Variant Execution on Selected Code PathsProceedings of the 25th International Middleware Conference10.1145/3652892.3654794(62-73)Online publication date: 2-Dec-2024
      • (2023)BoKASANProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620516(4985-5002)Online publication date: 9-Aug-2023
      • (2023)Go or No Go: Differential Fuzzing of Native and C Libraries2023 IEEE Security and Privacy Workshops (SPW)10.1109/SPW59333.2023.00036(349-363)Online publication date: May-2023
      • (2022)POPKORN: Popping Windows Kernel Drivers At ScaleProceedings of the 38th Annual Computer Security Applications Conference10.1145/3564625.3564631(854-868)Online publication date: 5-Dec-2022
      • (2022)SEEKER: A Root Cause Analysis Method Based on Deterministic Replay for Multi-Type Network Protocol Vulnerabilities2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)10.1109/TrustCom56396.2022.00029(131-138)Online publication date: Dec-2022
      • (2022)Unleashing Coveraged-Based Fuzzing Through Comprehensive, Efficient, and Faithful Exploitable-Bug ExposingIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2021.307985719:5(2998-3010)Online publication date: 1-Sep-2022
      • (2022)MVDetecter: Vulnerability Primitive-based General Memory Vulnerability Detection2022 IEEE Intl Conf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking (ISPA/BDCloud/SocialCom/SustainCom)10.1109/ISPA-BDCloud-SocialCom-SustainCom57177.2022.00056(386-393)Online publication date: Dec-2022
      • (2022)Anatomist: Enhanced Firmware Vulnerability Discovery Based on Program State Abnormality Determination with Whole-System ReplayInformation Security10.1007/978-3-031-22390-7_23(390-407)Online publication date: 9-Dec-2022
      • (2021)Study on Costs of Software-based Heterogeneous Redundant Execution2021 7th International Conference on Computer and Communications (ICCC)10.1109/ICCC54389.2021.9674362(1321-1324)Online publication date: 10-Dec-2021
      • (2020)pRnR: A Parallel Record-Replay Framework for Virtual Machines2020 IEEE 38th International Conference on Computer Design (ICCD)10.1109/ICCD50377.2020.00106(610-618)Online publication date: Oct-2020

      View Options

      Login options

      View options

      PDF

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      Figures

      Tables

      Media

      Share

      Share

      Share this Publication link

      Share on social media