Effective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers
主 講 人：白家駒 清華大學計算機系 操作系統實驗室
報告時間：2019年5月23日（周二）上午 10:00 – 12:00
報告地點：1048會議室
報告摘要 (Abstract)
In Linux device drivers, use-after-free (UAF) bugs can cause system crashes and serious security problems. According to our study of Linux kernel commits, nearly half of the driver commits fixing use-after-free bugs involve driver concurrency. Due to the non-determinism of concurrent execution, concurrency use-after-free bugs are often more difficult to reproduce and detect than sequential use-after-free bugs. In this talk, I will present a new static analysis approach named DCUAF, to effectively detect concurrency use-after-free bugs in Linux device drivers. DCUAF combines a local analysis analyzing the source code of each driver with a global analysis statistically analyzing the local results of all drivers, forming a local-global analysis, to extract the pairs of driver interface functions that may be concurrently executed. Then, with these pairs, DCUAF performs a summary-based lockset analysis to detect concurrency use-after-free bugs. DCUAF has been evaluated on the driver code in the Linux kernel, and found hundreds of real concurrency use-after-free bugs.
主講人簡介 (Short Bio)
白家駒博士是清華大學計算機系操作系統的博士后和助理研究員。他在2013年于西安電子科技大學獲得學士學位，并在2018年于清華大學獲得博士學位。他的博士畢業論文被評為清華大學優秀博士學位論文。他的主要研究方向為操作系統可靠性和內核程序分析，側重利用動態分析和靜態分析技術對操作系統源代碼進行缺陷檢測。他的研究工作發表在USENIX ATC、ASPLOS、CGO、JSS、IST等系統和軟件分析領域的會議和期刊中，并且在Linux、FreeBSD和NetBSD等常用操作系統代碼中發現了諸多真實的缺陷。