CREDAL: Towards locating a memory corruption vulnerability with your core dump

Jun Xu; Dongliang Mu; Ping Chen; Xinyu Xing; Pei Wang; Peng Liu

doi:10.1145/2976749.2978340

CREDAL: Towards locating a memory corruption vulnerability with your core dump

Jun Xu
, Dongliang Mu
, Ping Chen
, Xinyu Xing
, Pei Wang
, Peng Liu

College of Information Sciences and Technology

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

49 Scopus citations

Abstract

After a program has crashed and terminated abnormally, it typically leaves behind a snapshot of its crashing state in the form of a core dump. While a core dump carries a large amount of information, which has long been used for software debugging, it barely serves as informative debugging aids in locating software faults, particularly memory corruption vulnerabilities. A memory corruption is a special type of software fault that may lead to manipulation of the content at a certain memory. As such, a core dump may contain a certain amount of corrupted data, which increases the difficulty in identifying useful debugging information (e.g., a crash point and stack traces). Without a proper mechanism to deal with this problem, a core dump can be practically useless for software failure diagnosis. In this work, we develop CREDAL, an automatic debugging tool that employs the source code of a crashing program to enhance core dump analysis and turns a core dump to an informative aid in tracking down memory corruption vulnerabilities. Specifically, CREDAL systematically analyzes a potentially corrupted core dump and identifies the crash point and stack frames. For a core dump carrying corrupted data, it goes beyond the crash point and stack trace. In particular, CREDAL further pinpoints the variables holding corrupted data using the source code of the crashing program along with the stack frames. To assist software developers (or security analysts) in tracking down a memory corruption vulnerability, CREDAL also performs analysis and highlights the code fragments corresponding to data corruption. To demonstrate the utility of CREDAL, we use it to analyze 80 crashes corresponding to 73 memory corruption vulnerabilities archived in Offensive Security Exploit Database. We show that, CREDAL can accurately pinpoint the crash point and (fully or partially) restore a stack trace even though a crashing program stack carries corrupted data. In addition, we demonstrate CREDAL can potentially reduce the manual effort of finding the code fragment that is likely to contain memory corruption vulnerabilities.

Original language	English (US)
Title of host publication	CCS 2016 - Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security
Publisher	Association for Computing Machinery
Pages	529-540
Number of pages	12
ISBN (Electronic)	9781450341394
DOIs	https://doi.org/10.1145/2976749.2978340
State	Published - Oct 24 2016
Event	23rd ACM Conference on Computer and Communications Security, CCS 2016 - Vienna, Austria Duration: Oct 24 2016 → Oct 28 2016

Publication series

Name	Proceedings of the ACM Conference on Computer and Communications Security
Volume	24-28-October-2016
ISSN (Print)	1543-7221

Other

Other	23rd ACM Conference on Computer and Communications Security, CCS 2016
Country/Territory	Austria
City	Vienna
Period	10/24/16 → 10/28/16

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 3 Good Health and Well-being

All Science Journal Classification (ASJC) codes

Software
Computer Networks and Communications

Access to Document

10.1145/2976749.2978340

Cite this

Xu, J., Mu, D., Chen, P., Xing, X., Wang, P., & Liu, P. (2016). CREDAL: Towards locating a memory corruption vulnerability with your core dump. In CCS 2016 - Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (pp. 529-540). (Proceedings of the ACM Conference on Computer and Communications Security; Vol. 24-28-October-2016). Association for Computing Machinery. https://doi.org/10.1145/2976749.2978340

@inproceedings{c2801673642d479c8b361f3ab17fb0f6,

title = "CREDAL: Towards locating a memory corruption vulnerability with your core dump",

abstract = "After a program has crashed and terminated abnormally, it typically leaves behind a snapshot of its crashing state in the form of a core dump. While a core dump carries a large amount of information, which has long been used for software debugging, it barely serves as informative debugging aids in locating software faults, particularly memory corruption vulnerabilities. A memory corruption is a special type of software fault that may lead to manipulation of the content at a certain memory. As such, a core dump may contain a certain amount of corrupted data, which increases the difficulty in identifying useful debugging information (e.g., a crash point and stack traces). Without a proper mechanism to deal with this problem, a core dump can be practically useless for software failure diagnosis. In this work, we develop CREDAL, an automatic debugging tool that employs the source code of a crashing program to enhance core dump analysis and turns a core dump to an informative aid in tracking down memory corruption vulnerabilities. Specifically, CREDAL systematically analyzes a potentially corrupted core dump and identifies the crash point and stack frames. For a core dump carrying corrupted data, it goes beyond the crash point and stack trace. In particular, CREDAL further pinpoints the variables holding corrupted data using the source code of the crashing program along with the stack frames. To assist software developers (or security analysts) in tracking down a memory corruption vulnerability, CREDAL also performs analysis and highlights the code fragments corresponding to data corruption. To demonstrate the utility of CREDAL, we use it to analyze 80 crashes corresponding to 73 memory corruption vulnerabilities archived in Offensive Security Exploit Database. We show that, CREDAL can accurately pinpoint the crash point and (fully or partially) restore a stack trace even though a crashing program stack carries corrupted data. In addition, we demonstrate CREDAL can potentially reduce the manual effort of finding the code fragment that is likely to contain memory corruption vulnerabilities.",

author = "Jun Xu and Dongliang Mu and Ping Chen and Xinyu Xing and Pei Wang and Peng Liu",

note = "Publisher Copyright: {\textcopyright} 2016 ACM.; 23rd ACM Conference on Computer and Communications Security, CCS 2016 ; Conference date: 24-10-2016 Through 28-10-2016",

year = "2016",

month = oct,

day = "24",

doi = "10.1145/2976749.2978340",

language = "English (US)",

series = "Proceedings of the ACM Conference on Computer and Communications Security",

publisher = "Association for Computing Machinery",

pages = "529--540",

booktitle = "CCS 2016 - Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security",

}

Xu, J, Mu, D, Chen, P, Xing, X, Wang, P & Liu, P 2016, CREDAL: Towards locating a memory corruption vulnerability with your core dump. in CCS 2016 - Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. Proceedings of the ACM Conference on Computer and Communications Security, vol. 24-28-October-2016, Association for Computing Machinery, pp. 529-540, 23rd ACM Conference on Computer and Communications Security, CCS 2016, Vienna, Austria, 10/24/16. https://doi.org/10.1145/2976749.2978340

CREDAL: Towards locating a memory corruption vulnerability with your core dump. / Xu, Jun; Mu, Dongliang; Chen, Ping et al.
CCS 2016 - Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery, 2016. p. 529-540 (Proceedings of the ACM Conference on Computer and Communications Security; Vol. 24-28-October-2016).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - CREDAL

T2 - 23rd ACM Conference on Computer and Communications Security, CCS 2016

AU - Xu, Jun

AU - Mu, Dongliang

AU - Chen, Ping

AU - Xing, Xinyu

AU - Wang, Pei

AU - Liu, Peng

PY - 2016/10/24

Y1 - 2016/10/24

N2 - After a program has crashed and terminated abnormally, it typically leaves behind a snapshot of its crashing state in the form of a core dump. While a core dump carries a large amount of information, which has long been used for software debugging, it barely serves as informative debugging aids in locating software faults, particularly memory corruption vulnerabilities. A memory corruption is a special type of software fault that may lead to manipulation of the content at a certain memory. As such, a core dump may contain a certain amount of corrupted data, which increases the difficulty in identifying useful debugging information (e.g., a crash point and stack traces). Without a proper mechanism to deal with this problem, a core dump can be practically useless for software failure diagnosis. In this work, we develop CREDAL, an automatic debugging tool that employs the source code of a crashing program to enhance core dump analysis and turns a core dump to an informative aid in tracking down memory corruption vulnerabilities. Specifically, CREDAL systematically analyzes a potentially corrupted core dump and identifies the crash point and stack frames. For a core dump carrying corrupted data, it goes beyond the crash point and stack trace. In particular, CREDAL further pinpoints the variables holding corrupted data using the source code of the crashing program along with the stack frames. To assist software developers (or security analysts) in tracking down a memory corruption vulnerability, CREDAL also performs analysis and highlights the code fragments corresponding to data corruption. To demonstrate the utility of CREDAL, we use it to analyze 80 crashes corresponding to 73 memory corruption vulnerabilities archived in Offensive Security Exploit Database. We show that, CREDAL can accurately pinpoint the crash point and (fully or partially) restore a stack trace even though a crashing program stack carries corrupted data. In addition, we demonstrate CREDAL can potentially reduce the manual effort of finding the code fragment that is likely to contain memory corruption vulnerabilities.

AB - After a program has crashed and terminated abnormally, it typically leaves behind a snapshot of its crashing state in the form of a core dump. While a core dump carries a large amount of information, which has long been used for software debugging, it barely serves as informative debugging aids in locating software faults, particularly memory corruption vulnerabilities. A memory corruption is a special type of software fault that may lead to manipulation of the content at a certain memory. As such, a core dump may contain a certain amount of corrupted data, which increases the difficulty in identifying useful debugging information (e.g., a crash point and stack traces). Without a proper mechanism to deal with this problem, a core dump can be practically useless for software failure diagnosis. In this work, we develop CREDAL, an automatic debugging tool that employs the source code of a crashing program to enhance core dump analysis and turns a core dump to an informative aid in tracking down memory corruption vulnerabilities. Specifically, CREDAL systematically analyzes a potentially corrupted core dump and identifies the crash point and stack frames. For a core dump carrying corrupted data, it goes beyond the crash point and stack trace. In particular, CREDAL further pinpoints the variables holding corrupted data using the source code of the crashing program along with the stack frames. To assist software developers (or security analysts) in tracking down a memory corruption vulnerability, CREDAL also performs analysis and highlights the code fragments corresponding to data corruption. To demonstrate the utility of CREDAL, we use it to analyze 80 crashes corresponding to 73 memory corruption vulnerabilities archived in Offensive Security Exploit Database. We show that, CREDAL can accurately pinpoint the crash point and (fully or partially) restore a stack trace even though a crashing program stack carries corrupted data. In addition, we demonstrate CREDAL can potentially reduce the manual effort of finding the code fragment that is likely to contain memory corruption vulnerabilities.

UR - https://www.scopus.com/pages/publications/84995428282

UR - https://www.scopus.com/pages/publications/84995428282#tab=citedBy

U2 - 10.1145/2976749.2978340

DO - 10.1145/2976749.2978340

M3 - Conference contribution

AN - SCOPUS:84995428282

T3 - Proceedings of the ACM Conference on Computer and Communications Security

SP - 529

EP - 540

BT - CCS 2016 - Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

PB - Association for Computing Machinery

Y2 - 24 October 2016 through 28 October 2016

ER -

Xu J, Mu D, Chen P, Xing X, Wang P, Liu P. CREDAL: Towards locating a memory corruption vulnerability with your core dump. In CCS 2016 - Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery. 2016. p. 529-540. (Proceedings of the ACM Conference on Computer and Communications Security). doi: 10.1145/2976749.2978340

CREDAL: Towards locating a memory corruption vulnerability with your core dump

Abstract

Publication series

Other

UN SDGs

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this