• Corpus ID: 3804180

RICH: Automatically Protecting Against Integer-Based Vulnerabilities

  title={RICH: Automatically Protecting Against Integer-Based Vulnerabilities},
  author={David Brumley and Dawn Xiaodong Song and Tzi-cker Chiueh and Rob Johnson and Huijia Lin},
We present the design and implementation of RICH (Run-time Integer CHecking), a tool for efficiently detecting integer-based attacks against C programs at run time. C integer bugs, a popular avenue of attack and frequent programming error [1–15], occur when a variable value goes out of the range of the machine word used to materialize it, e.g. when assigning a large 32-bit int to a 16-bit short. We show that safe and unsafe integer operations in C can be captured by well-known sub-typing theory… 

Figures and Tables from this paper

BRICK: A Binary Tool for Run-Time Detecting and Locating Integer-Based Vulnerability
Preliminary experimental results are quit promising: BRICK can detect and locate most of integer-based vulnerability in real software, and has very low false positives and negatives.
A fast and low-overhead technique to secure programs against integer overflows
An algorithm that uses static range analysis to avoid some checks created by a dynamic instrumentation library that is implemented in LLVM and has been able to avoid 25% of all the overflow checks necessary to secure the C programs in the LLVM test suite.
Integers In C: An Open Invitation To Security Attacks?
An empirical study to explore how closely well-known, open source C programs follow the safe C standards for integer behavior finds that integer issues are ubiquitous and a preprocessor-aware, tool-assisted approach may be the most viable way to migrate legacy C code to comply with the standards for secure programming.
Practical Integer Overflow Prevention
The evaluation results show that IntGuard can precisely repair integer overflows with low computational and runtime overhead repair programs with very small binary and source code blow-up and is more time-effective and achieves a higher repair success rate than manually generated code repairs.
SMT-constrained symbolic execution engine for integer overflow detection in C code
An integer overflow checker which is based on precise modeling of C language semantics and symbolic function models is presented which is effective to be applied in future to C++ programs as well, in order to detect other kinds of vulnerabilities related to integers.
IntScope: Automatically Detecting Integer Overflow Vulnerability in X86 Binary Using Symbolic Execution
This paper presents a system, IntScope, which can automatically detect integer overflow vulnerabilities in x86 binaries before an attacker does, with the goal of finally eliminating the vulnerabilities.
As-If Infinitely Ranged Integer Model
The runtime overhead of the As-if Infinitely Ranged (AIR) Integer model is low enough that typical applications can enable it in deployed systems for additional runtime protection.
N ov 2 01 7 Practical Integer Overflow Prevention
INTGUARD is a symbolic execution based tool that can repair integer overflows with high-quality source code repairs and is more time-effective and achieves a higher repair success rate than manually generated code repairs.
IntPatch: Automatically Fix Integer-Overflow-to-Buffer-Overflow Vulnerability at Compile-Time
The design and implementation of IntPatch is presented, a compiler extension for automatically fixing IO2BO vulnerabilities in C/C++ programs at compile time, and it provides an interface for programmers to facilitate checking integer overflows.
Using type analysis in compiler to mitigate integer-overflow-to-buffer-overflow threat
The design and implementation of IntPatch is presented, a compiler extension for automatically fixing IO2BO vulnerabilities in C/C++ programs at compile time and provides an interface for programmers who want to check integer overflows manually.


Towards Automatically Eliminating Integer-Based Vulnerabilities
It is shown that well-known sub-typing theory commonly found in type-safe languages can effectively an automatically be applied to protect against most integer casting vulnerabilities in C.
CCured in the real world
This paper has extended the CCured type inference algorithm to recognize and verify statically a large number of type casts and presents a new instrumentation scheme that splits CCured's metadata into a separate data structure whose shape mirrors that of the original user data.
StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks
  • C. Cowan
  • Computer Science
    USENIX Security Symposium
  • 1998
StackGuard is described: a simple compiler technique that virtually eliminates buffer overflow vulnerabilities with only modest performance penalties, and a set of variations on the technique that trade-off between penetration resistance and performance.
MECA: an extensible, expressive system and language for statically checking security properties
A system and annotation language, MECA, for checking security rules, which provides a variety of practical constructs to effectively annotate large bodies of code and frees programmers from the heavy manual effort required by most past systems.
Efficient Techniques for Comprehensive Protection from Memory Error Exploits
This approach argues that this approach provides probabilistic protection against all memory error exploits, whether they be known or novel, and is implemented as a fully automatic source-to-source transformation which is compatible with legacy C code.
CMC: a pragmatic approach to model checking real code
A new model checker, CMC, which checks C and C++ implementations directly, eliminating the need for a separate abstract description of the system behavior, and reduces missed errors as well as time-wasting false error reports resulting from inconsistencies between the abstract description and the actual implementation.
CCured: type-safe retrofitting of legacy code
This paper describes the CCured type system, which extends that of C by separating pointer types according to their usage, and presents a surprisingly simple type inference algorithm that is able to infer the appropriate pointer kinds for existing C programs.
Types and programming languages
This text provides a comprehensive introduction both to type systems in computer science and to the basic theory of programming languages, with a variety of approaches to modeling the features of object-oriented languages.
A system and language for building system-specific, static analyses
A flexible, easy-to-use extension language for specifying analyses and an efficent algorithm for executing these extensions, which believe is an effective framework for deploying new bug-finding analyses quickly and easily.
CIL: Intermediate Language and Tools for Analysis and Transformation of C Programs
The structure of CIL is described, with a focus on how it disambiguates those features of C that were found to be most confusing for program analysis and transformation, allowing a complete project to be viewed as a single compilation unit.