Finding Bugs in Closed-source Software: An Open-source Static Binary Analysis Tool (written in Rust) (froscon2024)

Building a product with an entirely open-source software stack is still challenging at best - sometimes even infeasible. The past has shown that vulnerabilities in closed-source components may be exploited by attackers to undermine the security of a system. Attackers invest a considerable amount of effort and expertise into reverse-engineering these components to uncover complex vulnerabilities. Manufacturers that rely on closed source components oftentimes have neither the resources not the expertise to perform the same level of auditing. This imbalance leads to security issues in the final product that may directly impact its users. The cwe_checker is an open-source research prototype that performs static analysis of binary code to find potential vulnerabilities. It currently supports the analysis of Linux user space programs and kernel modules as well as bare-metal firmwares. Our goal is to reduce the time and expertise needed by vendors to thoroughly audit their closed-source dependencies. The talk will start with a short introduction to the general problem area, as outlined in the abstract, and proceed by introducing the goals behind the cwe_checker. It continues with a presentation of the idea, requirements, and high-level architecture of the cwe_checker. In its main part, the talk will walk through the development of a simple data-flow analysis that detects instances of CWE252 (Unchecked Return Value). It will cover both, conceptual aspects behind the static analysis algorithm and the concrete code that implements it using the internal cwe_checker APIs. Finally, the algorithm will be used to find unchecked return values of `copy_from_user`, a programming error that is almost certainly exploitable, in non-upstream Linux device drivers taken from embedded device firmware images. To conclude the talk, an overview of other available analyses as well as possible directions for future research will be given. Students interested in Rust and program analysis are invited to contact us for thesis projects and internship opportunities. External contributions to the cwe_checker have unfortunately been uncommon due to the steep learning curve and absence of walkthrough-style documentation. (There is detailed rustdoc documentation of all APIs.) It is hoped that this talk will equip interested listeners with information to start developing their own analysis ideas within the cwe_checker. about this event: https://programm.froscon.org/2024/events/3064.html