一句话：提出 STASE，结合规则静态分析与符号执行，自动生成 UEFI 漏洞签名，发现 PixieFail 与 EDKII 漏洞。
UEFI 权限高，漏洞检测至关重要，但静态分析可扩展却误报多，符号执行精确却受路径爆炸和约束求解开销限制。STASE 结合两者：先在 LLVM 位码上做基于规则的静态分析定位潜在漏洞目标，再对目标进行符号执行以精确检测并生成漏洞签名。它依赖人工指定可复用漏洞规则和攻击者控制输入，但自动生成引导符号执行的 harness，提升可用性与可扩展性。在 UEFI 代码库上评估，STASE 为 9 个近期 PixieFail 漏洞中的 5 个及 Tianocore EDKII 中 13 个新漏洞检测并生成签名。
Since its major release in 2006, the Unified Extensible Firmware Interface (UEFI) has become the industry standard for interfacing a computer’s hardware and operating system, replacing BIOS. UEFI has higher privileged security access to system resources than any other software component, including the system kernel. Hence, identifying and characterizing vulnerabilities in UEFI is extremely important for computer security. However, automated detection and characterization of UEFI vulnerabilities is a challenging problem. Static vulnerability analysis techniques are scalable but lack precision (reporting many false positives), whereas symbolic analysis techniques are precise but are hampered by scalability issues due to path explosion and the cost of constraint solving. In this paper, we introduce a technique called STatic Analysis guided Symbolic Execution (STASE), which integrates both analysis approaches to leverage their strengths and minimize their weaknesses. We begin with a rule-based static vulnerability analysis on LLVM bitcode to identify potential vulnerability targets for symbolic execution. We then focus symbolic execution on each target to achieve precise vulnerability detection and signature generation. STASE relies on the manual specification of reusable vulnerability rules and attacker-controlled inputs. However, it automates the generation of harnesses that guide the symbolic execution process, addressing the usability and scalability of symbolic execution, which typically requires manual harness generation to reduce the state space. We implemented and applied STASE to the implementations of UEFI code base. STASE detects and generates vulnerability signatures for 5 out of 9 recently reported PixieFail vulnerabilities and 13 new vulnerabilities in Tianocore’s EDKII codebase.
@inproceedings{ShafiuzzamanDSB24,
title = {STASE: Static Analysis Guided Symbolic Execution for UEFI Vulnerability Signature Generation},
author = {Md Shafiuzzaman and Achintya Desai and Laboni Sarker and Tevfik Bultan},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695543}
}