一句话：提出EmTaint，用结构化符号表达式按需别名分析提升嵌入式固件污点漏洞检测的准确率和速度。
该论文关注Linux嵌入式固件中污点式漏洞的静态检测。现有方法难以处理从攻击者可控源到安全敏感汇路径上的间接调用，造成大量漏报；同时中间污点源识别依赖启发式，精度不足，导致误报偏高。为此，作者提出EmTaint，首先设计基于结构化符号表达式（SSE）的按需别名分析技术，并在此基础上实现间接调用解析与精确污点分析，结合净化规则检查，从而在有限时间内准确发现大量污点式漏洞。作者在来自六家流行厂商的35个真实嵌入式固件样本上评估EmTaint，发现至少192个漏洞，其中41个n-day、151个0-day；截至写作时，已有至少115个CVE/PSV编号被分配。与KARONTE、SaTC等先进工具相比，EmTaint在同一数据集上用时更少且发现漏洞显著更多。
Although the importance of using static taint analysis to detect taint-style vulnerabilities in Linux-based embedded firmware is widely recognized, existing approaches are plagued by following major limitations: (a) Existing works cannot properly handle indirect call on the path from attacker-controlled sources to security-sensitive sinks, resulting in lots of false negatives. (b) They employ heuristics to identify mediate taint source and it is not accurate enough, which leads to high false positives. To address issues, we propose EmTaint, a novel static approach for accurate and fast detection of taint-style vulnerabilities in Linux-based embedded firmware. In EmTaint, we first design a structured symbolic expression-based (SSE-based) on-demand alias analysis technique. Based on it, we come up with indirect call resolution and accurate taint analysis scheme. Combined with sanitization rule checking, EmTaint can eventually discovers a large number of taint-style vulnerabilities accurately within a limited time. We evaluated EmTaint against 35 real-world embedded firmware samples from six popular vendors. The result shows EmTaint discovered at least 192 vulnerabilities, including 41 n-day vulnerabilities and 151 0-day vulnerabilities. At least 115 CVE/PSV numbers have been allocated from a subset of the reported vulnerabilities at the time of writing. Compared with state-of-the-art tools such as KARONTE and SaTC, EmTaint found significantly more vulnerabilities on the same dataset in less time.
@inproceedings{ChengZLG0LZYS23,
title = {Detecting Vulnerabilities in Linux-Based Embedded Firmware with SSE-Based On-Demand Alias Analysis},
author = {Kai Cheng and Yaowen Zheng and Tao Liu and Le Guan and Peng Liu and Hong Li and Hongsong Zhu and Kejiang Ye and Limin Sun},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598062}
}