MACKE: compositional analysis of low-level vulnerabilities with symbolic execution

Abstract

Concolic (concrete+symbolic) execution has recently gained popularity as an e↵ective means to uncover non-trivial vulnerabilities in software, such as subtle bu↵er overflows. However, symbolic execution tools that are designed to optimize statement coverage often fail to cover potentially vulnerable code because of complex system interactions and scalability issues of constraint solvers. In this paper, we present a tool (MACKE) that is based on the modular interactions inferred by static code analysis, which is combined with symbolic execution and directed inter-procedural path exploration. This provides an advantage in terms of statement coverage and ability to uncover more vulnerabilities. Our tool includes a novel feature in the form of interactive vulnerability report generation that helps developers prioritize bug fixing based on severity scores. A demo of our tool is available at https://youtu.be/icC3jc3mHEU.

Automatically assessing vulnerabilities discovered by compositional analysis

“…Compositional analysis or compositional symbolic execution has been proposed [11,29,32] as a mitigation strategy for the pathexplosion problem in simple symbolic execution. The basic idea of compositional analysis is as follows -instead of symbolically executing the full program, we symbolically execute all components, such as functions, that can be executed in isolation.…”

“…In this way, the symbolic execution engine would not have to deal with all those paths that do not constitute any communication-related instructions between the components. Macke [29] is such a compositional analysis tool for C language programs, where the components are functions. We will, briefly, formally describe the working of Macke.…”

“…It is the longest chain of callercallee pair through which the same vulnerability was discovered by Macke. The intuition behind this feature [29] is that if the same vulnerability can be exploited in a long chain, then it is more likely that a sanitization on passed arguments was not performed. We can see from the callgraph in figure 1 that the underlying "causes", or unsafe operation, for the vulnerabilities in ReadImage function are in std_fread and rle_fread.…”

“…We chose Macke for this, due to the following reasons. Firstly, Macke can find more vulnerabilities [29] in isolated functions, than forward symbolic execution. It also generates fewer false-positives than static-analyzers, such as Splint.…”

“…One such automated testing and vulnerability discovery tool is Macke [29]. Macke is a compositional analysis tool based on symbolic execution, that achieves higher instruction coverage and discovers more potential vulnerabilities in many open-source programs than forward (simple and without compositional analysis) symbolic execution tools, such as KLEE [7].…”