一句话：提出混合分析工具 ACHyb，用于检测内核访问控制漏洞，覆盖缺失权限检查与权限检查误用两类。
访问控制是操作系统安全的关键，但其错误实现会引入内核访问控制漏洞（KACV）。本文研究 KACV 的根因与安全影响，重点关注缺失权限检查（KACV-M）和误用权限检查（KACV-I），并发现超过 60% 的此类漏洞具有 critical、high 或 medium 安全等级，可造成绕过安全检查、权限提升等威胁。现有方法只能检测 KACV-M，且最先进的静态检测器 PeX 误报率极高。为此，作者提出 ACHyb，一种混合分析（hybrid analysis）方法，用于检测内核访问控制漏洞。摘要未给出具体实验评估结果，但该工作旨在覆盖两类 KACV 并改善现有静态分析的误报问题。
Access control is essential for the Operating System (OS) security. Incorrect implementation of access control can introduce new attack surfaces to the OS, known as Kernel Access Control Vulnerabilities (KACVs). To understand KACVs, we conduct our study on the root causes and the security impacts of KACVs. Regarding the complexity of the recognized root causes, we particularly focus on two kinds of KACVs, namely KACV-M (due to missing permission checks) and KACV-I (due to misusing permission checks). We find that over 60% of these KACVs are of critical, high or medium security severity, resulting in a variety of security threats including bypass security checking, privileged escalation, etc. However, existing approaches can only detect KACV-M. The state-of-the-art KACV-M detector called PeX is a static analysis tool, which still suffers from extremely high false-positive rates.
DOI 原文 ·
@inproceedings{paperbot6355,
title = {ACHyb: a hybrid analysis approach to detect kernel access control vulnerabilities},
author = {Yang Hu and Wenxi Wang and Casen Hunger and Riley Wood and Sarfraz Khurshid and Mohit Tiwari},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3468627}
}