AutoISES: Automatically Inferring Security Specifications and Detecting Violations

Transcription

1 : Automatically Inferring Security Specifications and Detecting Violations (U. of Illinois at Urbana-Champaign) Xiaolan (Catherine) Zhang (IBM Research) Xiao Ma, Weiwei Xiong, Yuanyuan Zhou (U. of Illinois at Urbana-Champaign)

2 Motivation Software security is critically important. Huge financial impact: $13-40 Billion loss to American business due to software vulnerabilities [Fortify] 2

3 Motivation Software security is critically important. Huge financial impact: $13-40 Billion loss to American business due to software vulnerabilities [Fortify] Mandatory Access Control (MAC) is proposed to provide stronger security. Already included in Linux kernel 2.6 series (Linux Security Modules) Xen (Xen Security Modules) 2

4 Background linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } 3

5 Background Security check function linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } 3

6 Background Security check function linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } Security sensitive operation 3

7 Background Security check function linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } Security sensitive operation All sensitive operations are authorized by the proper security check function. 3

8 Challenge Difficult to implement because sensitive operations are scattered throughout the code. E.g., file read/write in read(), readdir(), readv(), splice_read(), write(), writev(), splice_write(),... New operation instances may be added. 4

9 Challenge Difficult to implement because sensitive operations are scattered throughout the code. E.g., file read/write in read(), readdir(), readv(), splice_read(), write(), writev(), splice_write(),... New operation instances may be added. A missing/incorrect security check leads to security compromises. 4

10 A Real Vulnerability linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } linux/fs/readdir.c: ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } 5

11 A Real Vulnerability linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } linux/fs/readdir.c: ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } Same security sensitive operation: file read/write 5

12 A Real Vulnerability Security check linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } linux/fs/readdir.c: ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } Same security sensitive operation: file read/write 5

13 A Real Vulnerability Security check Forgot to call security_file_permission(). linux/fs/read_write.c: linux/fs/readdir.c: linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } Same security sensitive operation: file read/write 5

14 The Gap Want to check: All sensitive operations are authorized by the proper security check. 6

15 Want to check: The Gap All sensitive operations are authorized by the proper security check. High-level property: Too abstract to verify. 6

16 Want to check: The Gap All file read/write operations are protected by security_file_permission(). High-level property: Too abstract to verify. 6

17 Want to check: The Gap All file read/write operations are protected by security_file_permission(). High-level property: Too abstract to verify. Code-level rules: Can be directly used for checking but difficult to write and maintain. 6

18 Want to check: The Gap All file read/write operations are protected by security_file_permission(). High-level property: Too abstract to verify. Security Check Function: security_file_permission Security Sensitive Operation (A group of data structure accesses): 1. READ inode->i_size 12. READ address_space->tree_lock 2. READ file->f_flags 13. READ page->_count 3. READ file->f_pos 14. READ page->flags 4. READ file->f_dentry 15. WRITE page->index 5. READ file->f_dentry->d_inode 16. READ page->mapping 6. READ file->f_vfsmnt 17. WRITE page->mapping 7. READ dentry->d_inode 18. READ pglist_data->node_zonelists 8. READ address_space->flags 19. READ zone->wait_table 9. READ address_space->nrpages 20. READ zone->wait_table_bits 10. WRITE address_space->nrpages 21. READ (Global) nr_pagecache 11. READ address_space->page_tree 22. READ (Global) zone_table Code-level rules: Can be directly used for checking but difficult to write and maintain. 6

19 Want to check: The Gap All file read/write operations are protected by security_file_permission(). High-level property: Too abstract to verify. Security Check Function: security_file_permission Security Sensitive Operation (A group of data structure accesses): 1. READ inode->i_size 2. READ file->f_flags 3. READ file->f_pos 4. READ file->f_dentry 5. READ file->f_dentry->d_inode 6. READ file->f_vfsmnt 7. READ dentry->d_inode 8. READ address_space->flags 9. READ address_space->nrpages Don t try to read it. 10. WRITE address_space->nrpages 11. READ address_space->page_tree 12. READ address_space->tree_lock 13. READ page->_count 14. READ page->flags 15. WRITE page->index 16. READ page->mapping 17. WRITE page->mapping 18. READ pglist_data->node_zonelists 19. READ zone->wait_table 20. READ zone->wait_table_bits 21. READ (Global) nr_pagecache 22. READ (Global) zone_table Auto-generated by Code-level rules: Can be directly used for checking but difficult to write and maintain. 6

20 Want to check: The Gap All file read/write operations are protected by security_file_permission(). High-level property: Too abstract to verify. Gap Security Check Function: security_file_permission Security Sensitive Operation (A group of data structure accesses): 1. READ inode->i_size 2. READ file->f_flags 3. READ file->f_pos 4. READ file->f_dentry 5. READ file->f_dentry->d_inode 6. READ file->f_vfsmnt 7. READ dentry->d_inode 8. READ address_space->flags 9. READ address_space->nrpages Don t try to read it. 10. WRITE address_space->nrpages 11. READ address_space->page_tree 12. READ address_space->tree_lock 13. READ page->_count 14. READ page->flags 15. WRITE page->index 16. READ page->mapping 17. WRITE page->mapping 18. READ pglist_data->node_zonelists 19. READ zone->wait_table 20. READ zone->wait_table_bits 21. READ (Global) nr_pagecache 22. READ (Global) zone_table Auto-generated by Code-level rules: Can be directly used for checking but difficult to write and maintain. 6

21 Idea Automatically infer code-level security specifications/rules from the common case Rationale: Released code is mostly correct. 7

22 Idea Automatically infer code-level security specifications/rules from the common case Rationale: Released code is mostly correct. shares rationale with previous studies. [Ernst et al. 00], [Engler et al. 01], [Ammons et al. 02], [Li et al. 05], [Lu et al. 07] We extract a different type of rules. Extracting different rules require different techniques. 7

23 Contributions First to automatically infer code-level security specifications and detect violations Extracted 84 rules and detected 8 security violations (7 confirmed by developers) from the latest versions of the Linux kernel and Xen Bridged the gap more secure software. Quantitatively evaluated 4 different levels of rules granularity (in our paper) 8

24 Contributions Focus of this Talk First to automatically infer code-level security specifications and detect violations Extracted 84 rules and detected 8 security violations (7 confirmed by developers) from the latest versions of the Linux kernel and Xen Bridged the gap more secure software. Quantitatively evaluated 4 different levels of rules granularity (in our paper) 8

25 Outline Motivation, Challenges & Contributions Our Approach Evaluation & Results Related work Automatically infer code-level security specs Automatically detect violations to these specs Conclusions 9

26 Rule Inference Problem Given Source code, and A set of N security check functions 10

27 Rule Inference Problem Given Source code, and A set of N security check functions Infer a set of rules in the form of <Checki, Opi>, where Opi <protectedby Checki, 1<= i <= N Opi: security sensitive operation Checki: security check function 10

28 Challenges Rule: <Checki, Opi>, where Opi <protectedby Checki 11

29 Challenges 1. How to represent Opi? Rule: <Checki, Opi>, where Opi <protectedby Checki 11

30 Challenges 1. How to represent Opi? 2. How to define protected? Rule: <Checki, Opi>, where Opi <protectedby Checki 11

31 Challenges 1. How to represent Opi? 2. How to define protected? Rule: <Checki, Opi>, where Opi <protectedby Checki Usually documented: e.g., security_file_permission() 11

32 Challenges 1. How to represent Opi? 2. How to define protected? Rule: <Checki, Opi>, where Opi <protectedby Checki 11

33 Challenges 1. How to represent Opi? 2. How to define protected? Rule: <Checki, Opi>, where Opi <protectedby Checki 3. Where to start the analysis? 4. How to infer rules? 5. How to rank violations? 11

34 Representing Sensitive Op Using functions to represent sensitive operations??? linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } linux/fs/readdir.c: ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } 12

35 Representing Sensitive Op Using functions to represent sensitive operations??? linux/fs/read_write.c: linux/fs/readdir.c: linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } Problem Same security sensitive operation can be mapped to different functions. Find nothing in common for file read/write operation 12

36 Key Observation linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } linux/fs/readdir.c: ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } 13

37 Key Observation linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } do_sync_read() linux/fs/readdir.c: ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } 13

38 Key Observation linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } do_sync_read() linux/fs/readdir.c: ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } filp->f_op->aio_read() 13

39 Key Observation linux/fs/read_write.c: ssize_t vfs_read() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->read(file, ); } } do_sync_read() linux/fs/readdir.c: ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } filp->f_op->aio_read() linux/mm/filemap.c: ssize_t generic_file_aio_read() {... struct file *filp =...; if (filp->f_flags & O_DIRECT) { } } 13

40 Key Observation linux/fs/read_write.c: linux/mm/filemap.c: ssize_t vfs_read() generic_file_aio_read() { {... ret struct = security_file_permission(file, *filp =...; ); if (!ret) (filp->f_flags { & O_DIRECT) { } ret } = file->f_op->read(file, ); } } linux/fs/readdir.c: ssize_t vfs_readdir() { ret = security_file_permission(file, ); if (!ret) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } 13

41 Key Observation linux/fs/read_write.c: linux/mm/filemap.c: ssize_t vfs_read() generic_file_aio_read() { {... ret struct = security_file_permission(file, *filp =...; ); if (!ret) (filp->f_flags { & O_DIRECT) { } ret } = file->f_op->read(file, ); } } linux/include/linux/fs.h: linux/fs/readdir.c: ssize_t static inline vfs_readdir() void file_accessed( { ret = security_file_permission(file, struct * file) ); {... if if (!ret) (file->f_flags { & O_NOATIME) { ret = file->f_op->readdir(file, ); } } linux/fs/read_write.c: ssize_t do_readv_writev() { ret = file->f_op->readv(file, ); } 13

42 Key Observation linux/fs/read_write.c: linux/mm/filemap.c: ssize_t vfs_read() generic_file_aio_read() { {... ret struct = security_file_permission(file, *filp =...; ); if (!ret) (filp->f_flags { & O_DIRECT) { } ret } = file->f_op->read(file, ); } } linux/include/linux/fs.h: linux/fs/readdir.c: ssize_t static inline vfs_readdir() void file_accessed( { ret = security_file_permission(file, struct * file) ); {... if if (!ret) (file->f_flags { & O_NOATIME) { ret = file->f_op->readdir(file, ); } } linux/mm/filemap.c: linux/fs/read_write.c: ssize_t generic_file_aio_read() do_readv_writev() { {... ret struct = file->f_op->readv(file, *filp =...; ); if (filp->f_flags & O_DIRECT) } } } 13

43 Key Observation linux/fs/read_write.c: linux/mm/filemap.c: ssize_t vfs_read() generic_file_aio_read() { {... ret struct = security_file_permission(file, *filp =...; ); if (!ret) (filp->f_flags { & O_DIRECT) { } ret } = file->f_op->read(file, ); } } linux/include/linux/fs.h: linux/fs/readdir.c: ssize_t static inline vfs_readdir() void file_accessed( { ret = security_file_permission(file, struct * file) ); {... if if (!ret) (file->f_flags { & O_NOATIME) { ret = file->f_op->readdir(file, ); } } linux/mm/filemap.c: linux/fs/read_write.c: ssize_t generic_file_aio_read() do_readv_writev() { {... ret struct = file->f_op->readv(file, *filp =...; ); if (filp->f_flags & O_DIRECT) } } } Ultimately the same operations access the same data structures. e.g., READ file->f_flags, READ inode->i_size,... Because security checks are designed to protect data. 13

44 Security Specification A set of tuples <Checki, Opi> Opi := {Access}+ Access := READ AST WRITE AST AST := typename( field)+ global variable Use a group of data structure accesses to represent a security op. 14

45 Defining Protected All data accesses that occur after the check An approximation of the true protected data accesses Can include unrelated accesses (noises) But noises can be eliminated during rule inference (later) and violation detection (in paper). 15

46 Where to Start the Analysis? security check data structure access 16 function function call

47 Where to Start the Analysis? security check data structure access 16 function function call

48 Where to Start the Analysis? security check data structure access 16 function function call

49 Where to Start the Analysis? security check data structure access 16 function function call

50 Where to Start the Analysis? Obviously, the triangles are protected. Naive approach Starting from the direct callers of security checks security check data structure access 16 function function call

51 Where to Start the Analysis? Obviously, the triangles are protected. Naive approach Starting from the direct callers of security checks Problem Find NO security sensitive operation after the check because direct callers are wrapper functions. security check data structure access 16 function function call

52 Where to Start the Analysis? Obviously, the triangles are protected. Naive approach Starting from the direct callers of security checks Problem Find NO security sensitive operation after the check because direct callers are wrapper functions. linux/fs/namei.c: int permission(struct inode *inode,...) {... return security_inode_permission(inode); } security check data structure access 16 function function call

53 Root Functions Our approach (automatic) : Break the program into modules Based on build configuration (e.g., makefile) Identify root functions of each module Functions that do not have callers Call graph analysis 17

54 Rule Inference For each root function Extract data structure accesses after each security check 18

55 Rule Inference For each root function Extract data structure accesses after each security check From sys_read() 1. READ inode->i_size 2. READ file->f_flags 3. READ sock_iocb->async_msg 4. WRITE msghdr->msg_name... From old_readdir() 1. READ inode->i_size 2. READ file->f_flags 3. READ readdir_callback->result 4. WRITE readdir_callback->result... Static traces from other root functions are not shown. 18

56 Rule Inference For each root function Extract data structure accesses after each security check Compute the intersection of all sets of data structure accesses for the same security check Can mask noises From sys_read() 1. READ inode->i_size 2. READ file->f_flags 3. READ sock_iocb->async_msg 4. WRITE msghdr->msg_name... From old_readdir() 1. READ inode->i_size 2. READ file->f_flags 3. READ readdir_callback->result 4. WRITE readdir_callback->result... Static traces from other root functions are not shown. 18

57 Rule Inference For each root function Extract data structure accesses after each security check Compute the intersection of all sets of data structure accesses for the same security check Can mask noises From sys_read() 1. READ inode->i_size 2. READ file->f_flags 3. READ sock_iocb->async_msg 4. WRITE msghdr->msg_name... From old_readdir() 1. READ inode->i_size 2. READ file->f_flags 3. READ readdir_callback->result 4. WRITE readdir_callback->result... Static traces from other root functions are not shown. 18

58 Rule Inference For each root function Extract data structure accesses after each security check Compute the intersection of all sets of data structure accesses for the same security check Can mask noises From sys_read() 1. READ inode->i_size 2. READ file->f_flags 3. READ sock_iocb->async_msg 4. WRITE msghdr->msg_name... From old_readdir() 1. READ inode->i_size 2. READ file->f_flags 3. READ readdir_callback->result 4. WRITE readdir_callback->result... Static traces from other root functions are not shown. 18

59 Rule Inference For each root function Extract data structure accesses after each security check Compute the intersection of all sets of data structure accesses for the same security check Can mask noises Security rule: security_file_permission 1. READ inode->i_size 2. READ file->f_flags... Static traces from other root functions are not shown. 18

60 Violation Ranking Untrusted-space exposability study No need to protect sensitive operations initiated from the trusted space (e.g, kernel). Automatic reachability study from export functions (e.g., syscalls for Linux, hypercalls for Xen) Errors: definitely exposable to the untrusted space Warnings: possibly exposable to the untrusted space 19

61 Violation Ranking Untrusted-space exposability study No need to protect sensitive operations initiated from the trusted space (e.g, kernel). Automatic reachability study from export functions (e.g., syscalls for Linux, hypercalls for Xen) Errors: definitely exposable to the untrusted space Warnings: possibly exposable to the untrusted space The more accesses matched, the more likely to be a sensitive operation. 19

62 Static Analysis Inter-procedural, flow-insensitive For both rule inference and violation detection 20

63 Static Analysis Inter-procedural, flow-insensitive For both rule inference and violation detection Inter-procedural required by the problem Data accesses for the same operation can be as far as 18 levels apart in the call chain Simple function pointer alias analysis 20

64 Static Analysis Inter-procedural, flow-insensitive For both rule inference and violation detection Inter-procedural required by the problem Data accesses for the same operation can be as far as 18 levels apart in the call chain Simple function pointer alias analysis Flow-insensitive because of scalability 20

65 Outline Motivation, Challenges & Contributions Our Approach Evaluation & Results Related work Automatically infer code-level security specs Automatically detect violations to these specs Conclusions 21

66 Evaluated Software Software Lines of Code Total # of Checks Linux 5.0M 96 Xen 0.3M 67 focused on permission checks. Excluding initialization and clean-up checks 22

67 Results & Overhead Software # of rules # of True Violations # False Positives in Errors # of Warnings # Inspected # Uninspected Linux /6 25(2) 265 Xen /2 3 0 Total /8 28(2)

68 Results & Overhead Software # of rules # of True Violations # False Positives in Errors # of Warnings # Inspected # Uninspected Linux /6 25(2) 265 Xen /2 3 0 Total /8 28(2)

69 Results & Overhead Software # of rules # of True Violations # False Positives in Errors # of Warnings # Inspected # Uninspected Linux /6 25(2) 265 Xen /2 3 0 Total /8 28(2) out of the 8 true violations are already confirmed by the corresponding developers. 23

70 Results & Overhead Software # of rules # of True Violations # False Positives in Errors # of Warnings # Inspected # Uninspected Linux /6 25(2) 265 Xen /2 3 0 Total /8 28(2) out of the 8 true violations are already confirmed by the corresponding developers. Error reports have a reasonable false positive rate. 23

71 Results & Overhead Software # of rules # of True Violations # False Positives in Errors # of Warnings # Inspected # Uninspected Linux /6 25(2) 265 Xen /2 3 0 Total /8 28(2) out of the 8 true violations are already confirmed by the corresponding developers. Error reports have a reasonable false positive rate. 23

72 Results & Overhead Software # of rules # of True Violations # False Positives in Errors # of Warnings # Inspected # Uninspected Linux /6 25(2) 265 Xen /2 3 0 Total /8 28(2) out of the 8 true violations are already confirmed by the corresponding developers. Error reports have a reasonable false positive rate. 23

73 Results & Overhead Software # of rules # of True Violations # False Positives in Errors # of Warnings # Inspected # Uninspected Linux /6 25(2) 265 Xen /2 3 0 Total /8 28(2) out of the 8 true violations are already confirmed by the corresponding developers. Error reports have a reasonable false positive rate. On average, 2 hrs for rule generation + detection 23

74 Detected Violations (I) linux/fs/sys_splice.c: static long do_splice_from(, struct file * out,...) { linux/fs/sys_splice.c: static long do_splice_to( struct file * in,...) { return out->f_op->splice_write(); } return in->f_op->splice_read(); } 24

75 Detected Violations (I) linux/fs/sys_splice.c: static long do_splice_from(, struct file * out,...) { linux/fs/sys_splice.c: static long do_splice_to( struct file * in,...) { Exploitable Violations! Forgot to call security_file_permission(). return out->f_op->splice_write(); } return in->f_op->splice_read(); } 24

76 Detected Violations (II) linux/net/decnet/netfilter/dn_rtmsg.c: static inline void dnrmg_receive_user_skb(...) { } if (!cap_raised(...)) RCV_SKB_FAIL(_EPERM); 25

77 Detected Violations (II) linux/net/decnet/netfilter/dn_rtmsg.c: static inline void dnrmg_receive_user_skb(...) { Inconsistency Violations! Should use security_netlink_recv() instead. } if (!cap_raised(...)) RCV_SKB_FAIL(_EPERM); 25

78 Related Work Detecting security violations [Zhang et al. 02][Edwards et al. 02] [Jaeger et al. 04] Require rules to be given. 26

79 Related Work Detecting security violations [Zhang et al. 02][Edwards et al. 02] [Jaeger et al. 04] Require rules to be given. Retrofitting legacy code [Ganapathy et al. 06 & 07] Different goal: adding security checks Need prior knowledge about the API & sensitive data types Require manual refinement. 26

80 Related Work Detecting security violations [Zhang et al. 02][Edwards et al. 02] [Jaeger et al. 04] Require rules to be given. Retrofitting legacy code [Ganapathy et al. 06 & 07] Different goal: adding security checks Need prior knowledge about the API & sensitive data types Require manual refinement. Inferring programming rules [Ernst et al. 00], [Engler et al. 01], [Ammons et al. 02], [Li et al. 05], [Lu et al. 07] Extract different types of rules 26

81 Conclusions Automatically extract code-level specifications and detect security violations Extracted 84 rules and detected 8 security violations from the latest versions of the Linux kernel and Xen Close a critical gap between secure design and secure implementation 27

82 Conclusions Automatically extract code-level specifications and detect security violations Extracted 84 rules and detected 8 security violations from the latest versions of the Linux kernel and Xen Close a critical gap between secure design and secure implementation Lots of opportunities for future research Apply to more security properties Use faster and more precise static analysis 27

83 Thank you! Questions? (U. of Illinois at Urbana-Champaign) Xiaolan (Catherine) Zhang (IBM Research) Xiao Ma, Weiwei Xiong, Yuanyuan Zhou (U. of Illinois at Urbana-Champaign)