一句话：结合流敏感类型限定符分析与符号执行，实现 Linux 内核中精确且可扩展的未初始化使用缺陷检测。
Linux 内核中的 use-before-initialization（UBI）缺陷可导致信息泄露和权限提升。强制初始化可能引入 NULL 指针解引用等未定义行为，因此检测并人工修补是更好的缓解方式。精确检测 UBI 需要路径敏感分析，跟踪变量在各执行路径上的初始化状态，但这难以扩展到整个内核。UBITect 将流敏感类型限定符分析与符号执行结合：限定符分析筛选可能引发 UBI 的变量，并引导符号执行精确检查；它无需人工注解，也不修改源码或中间表示。在 Linux 4.14 上，它报告 190 个缺陷，其中 78 个被判为真阳性，52 个被维护者确认。
Use-before-Initialization (UBI) bugs in the Linux kernel have serious security impacts, such as information leakage and privilege escalation. Developers are adopting forced initialization to cope with UBI bugs, but this approach can still lead to undefined behaviors (e.g., NULL pointer dereference). As it is hard to infer correct initialization values, we believe that the best way to mitigate UBI bugs is detection and manual patching. Precise detection of UBI bugs requires path-sensitive analysis. The detector needs to track an associated variable’s initialization status along all the possible program execution paths to its uses. However, such exhaustive analysis prevents the detection from scaling to the whole Linux kernel. This paper presents UBITect, a UBI bug finding tool which combines flow-sensitive type qualifier analysis and symbolic execution to perform precise and scalable UBI bug detection. The scalable qualifier analysis guides symbolic execution to analyze variables that are likely to cause UBI bugs. UBITect also does not require manual effort for annotations and hence, it can be directly applied to the kernel without any source code or intermediate representation (IR) change. On the Linux kernel version 4.14, UBITect reported 190 bugs, among which 78 bugs were deemed by us as true positives and 52 were confirmed by Linux maintainers.
@inproceedings{paperbot5826,
title = {UBITect: a precise and scalable method to detect use-before-initialization bugs in Linux kernel},
author = {Yizhuo Zhai and Yu Hao and Hang Zhang and Daimeng Wang and Chengyu Song and Zhiyun Qian and Mohsen Lesani and Srikanth V. Krishnamurthy and Paul Yu},
booktitle = {FSE},
year = {2020},
doi = {10.1145/3368089.3409686}
}