Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers

Jia-Ju Bai (1) , Julia L. Lawall (2) , Qiu-Liang Chen (1) , Shi-Min Hu (3)

1 THU - Tsinghua University [Beijing]
2 Whisper - Well Honed Infrastructure Software for Programming Environments and Runtimes
3 CST - Department of Computer Science and Technology

In Linux device drivers, use-after-free (UAF) bugs can cause system crashes and serious security problems. According to our study of Linux kernel commits, 42% of the driver commits fixing use-after-free bugs involve driver concurrency. We refer to these use-after-free bugs as concurrency use-after-free bugs. Due to the non-determinism of concurrent execution, concurrency use-after-free bugs are often more difficult to reproduce and detect than sequential use-after-free bugs. In this paper, we propose a practical static analysis approach named DCUAF, to effectively detect concurrency use-after-free bugs in Linux device drivers. DCUAF combines a local analysis analyzing the source code of each driver with a global analysis statistically analyzing the local results of all drivers, forming a local-global analysis, to extract the pairs of driver interface functions that may be concurrently executed. Then, with these pairs, DCUAF performs a summary-based lockset analysis to detect concurrency use-after-free bugs. We have evaluated DCUAF on the driver code of Linux 4.19, and found 640 real concurrency use-after-free bugs. We have randomly selected 130 of the real bugs and reported them to Linux kernel developers, and 95 have been confirmed.

Domaines: Système d'exploitation [cs.OS]

Jia-Ju Bai, Julia L. Lawall, Qiu-Liang Chen, Shi-Min Hu. Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers. 2019 USENIX Annual Technical Conference, Jul 2019, Renton, Washington, United States. ⟨hal-02182516⟩