一句话：提出反例引导的归纳推断，在修复位置生成补丁不变式，从而仅凭一个失败输入修复漏洞。
程序漏洞即使被检测和报告，也常因修复滞后而长期暴露于攻击。本文提出一种反例引导的归纳推断过程，在可能修复位置对程序状态进行变异，从而推断“补丁不变式”，并利用简单补丁模板生成补丁。方法假设仅有一个失败输入（代表漏洞利用）可用于启动修复。作者在 VulnLoc 数据集的 39 个漏洞上评估，与基于 concolic 执行的 CPR 和基于符号执行的 SenX 等漏洞修复方法相比，能够修复显著更多的漏洞。结果展示了通过归纳约束推断进行程序修复的潜力，而非仅依赖对给定测试套件的演绎/符号分析来生成修复约束。
Program vulnerabilities, even when detected and reported, are not fixed immediately. The time lag between the reporting and fixing of a vulnerability causes open-source software systems to suffer from significant exposure to possible attacks. In this paper, we propose a counter-example guided inductive inference procedure over program states to define likely invariants at possible fix locations. The likely invariants are constructed via mutation over states at the fix location, which turns out to be more effective for inductive property inference, as compared to the usual greybox fuzzing over program inputs. Once such likely invariants, which we call patch invariants, are identified, we can use them to construct patches via simple patch templates. Our work assumes that only one failing input (representing the exploit) is available to start the repair process. Experiments on the VulnLoc data-set of 39 vulnerabilities, which has been curated in previous works on vulnerability repair, show the effectiveness of our repair procedure. As compared to proposed approaches for vulnerability repair such as CPR or SenX which are based on concolic and symbolic execution respectively, we can repair significantly more vulnerabilities. Our results show the potential for program repair via inductive constraint inference, as opposed to generating repair constraints via deductive/symbolic analysis of a given test-suite.
DOI 原文 ·
@inproceedings{paperbot7443,
title = {Program vulnerability repair via inductive inference},
author = {Yuntong Zhang and Xiang Gao and Gregory J. Duck and Abhik Roychoudhury},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534387}
}