Towards the exploitability escalation for software vulnerabilities

The development of static and dynamic analysis tools significantly improves security analysts' capability in finding software bugs., However, security analysts lack effective, efficient methods to determine the exploitability for the identified bugs. Today, securi,ty analysts heavily rely upon their own expertise and experience in exploitability assessment. As a result, the bugs not yet demonst,rated exploitability may not result from their unexploitability. Our past research indicates that determining exploitability require,s tackling three critical technical challenges - (1) tracking down useful exploitation primitives, (2) bypassing exploit mitigation, and protection commonly deployed, (3) preventing unexpected program termination. To this end, I propose a series of technical appro,aches to ease the development of working exploits and escalate the capability of a security analyst in assessing exploitability for, vulnerabilities. To be more specific, I conduct this research from three aspects. First, I developed automated techniques to explor,e the primitives needed for exploitation. Using the primitives identified, I further designed and developed technical solutions to f,acilitate the ability of a security analyst to bypass security mitigation and thus explore the possibility of performing exploitatio,n. Looking ahead, I will explore practical approaches to preventing unexpected termination in vulnerability exploitation. In the pas,t 2 years, my research endeavor has primarily focused on useful primitive identification and mitigation circumvention. Until submitt,ing this updated proposal, my students and I have built two open-sourced systems - ELOISE and GREBE, and the corresponding research, results have been published at top-tier security conferences (IEEE S&P and CCS). As is mentioned above, this proposal will focus on, the last stage of the research. That is to explore solutions to stabilize exploitation and thus prevent unexpected termination in a,n exploitation process. Intellectual Merit. This project will make key innovations in software vulnerability analysis and exploitabi,lity assessment. If successful, the research outcome will provide a series of novel technical solutions that will help security anal,ysts to (1) track down primitives needed for exploitation, (2) evaluate the capability of a vulnerability in circumventing widely de,ployed security mitigation and (3) prevent unexpected termination in exploitability assessment. Not only will this work enrich the a,rsenal of computer security, but also contribute to the field of software engineering that focuses on aut,is and exploit development. The proposed research will apply empirical methods from computer systems and software engineering to tac,kle conventional but unsolved security problems. Broader Impact. This research project has the potential to significantly reduce the, cycle of exploitability assessment for vulnerabilities and thus shorten the time that a software system remains vulnerable. The pro,posed research will make key progress towards securing the current cyberspace and enhancing the national security. The technical sol,utions will not only help to build a more effective and efficient bug triaging system for industrial practitioners, but also augment, their ability to perform more comprehensive and thorough penetration test in their regular cyber operations. The PI will continue s,haring the research results with existing industrial partners and collaborate on prototype testing. Keyword: Exploitability assessme,nt, symbolic execution, security mitigation, memory corruption vulnerability