FlowTwist: Efficient Context-Sensitive Inside- Out Taint Analysis for Large Codebases

Transcription

1 FlowTwist: Efficient Context-Sensitive Inside- Out Taint Analysis for Large Codebases Johannes Lerch, Ben Hermann, Eric Bodden, and Mira Mezini Technische Universität Darmstadt Software Technology Group 1

2 Oracle patches Java 7 vulnerability Breaking its quarterly update schedule, Oracle has released a new Java runtime that addresses recent security flaws. Aug 30,

3 Theory: Stack-based Access Control SecurityManager.checkPermission FilePermission, SocketPermission,... SecurityManager.checkWrite FilePermission, SocketPermission,... FileOutputStream.<init> FilePermission, SocketPermission,... Attacker.doEvil MyApplet.init Ø Ø = Ø 3

4 Theory: Stack-based Access Control public static Class<?> forname(string classname) throws ClassNotFoundException { return forname0(classname, true, ClassLoader.getCallerClassLoader()); Implicit Permission Check Class.forName Privileged ClassLoader Attacker.doEvil Unprivileged ClassLoader MyApplet.init Unprivileged ClassLoader 4

5 Leak in sun.beans.finder.classfinder (CVE ) public static Class<?> findclass(string classname) { try { ClassLoader cl = return Class.forName(className, false, cl); catch (ClassNotFoundException e) { throws SecurityException catch (SecurityException e) { return Class.forName(className); handled here 5

6 Leak in sun.beans.finder.classfinder (CVE ) public static Class<?> findclass(string classname) { try { ClassLoader cl = return Class.forName(className, Privileged false, ClassLoader cl); ClassFinder.findClass Privileged ClassLoader catch (ClassNotFoundException e) { Attacker.doEvil Unprivileged ClassLoader MyApplet.init catch (SecurityException e) { Unprivileged ClassLoader throws SecurityException return Class.forName(className); handled here 6

7 Deriving the Static Program Analysis Problem Caller Sensitive Track the return value Class.forName Privileged ClassLoader ClassFinder.findClass Privileged ClassLoader Attacker.doEvil MyApplet.init Unprivileged ClassLoader Unprivileged ClassLoader Track the parameter 7

8 Two Independent Analyses Source Caller Sensitive Sink Track the return value Track the parameter Sink Source 8

9 Two Independent Analyses: Not Context-Sensitive Caller Sensitive Track the return value Track the parameter 9

10 Pure Forward Context-Sensitive Approach Caller Sensitive Source Sink 10

11 Runtime [min] Results only Class.forName Maximum Heap Size [GB] 11

12 Runtime [min] Results all Caller Sensitive Methods Maximum Heap Size [GB] 12

13 Scale of the Problem Caller Sensitive ~45,000 methods 13

14 Scale of the Problem 64 methods Caller Sensitive 3,656 call sites ~45,000 methods 14

15 Exploit Imbalance to Improve Scalability 64 methods Caller Sensitive 3,656 call sites ~45,000 methods 15

16 IFDS Algorithm [17,19] Reports Leaks Caller Sensitive? 16

17 IFDS Algorithm: Computing Summaries a {a foo(a) { 1: a {a, b 2: b = a c = b a {a, b 3: return c 17

18 IFDS Algorithm: Computing Summaries foo(a) { 1: a {a, b 2: a {a, b, c 3: b = a c = b return c a {a b {b, c 18

19 IFDS Algorithm: Computing Summaries foo(a) { 1: b = a 2: a {a, b, c 3: c = b return c 19

20 Path Construction foo(a) { 1: b = a a {a, b pred(b) = a stmt(b) = #1 2: a {a, b, c 3: c = b return c a {a b {b, c pred(c) = b stmt(c) = #2 20

21 Path Construction: Merge at Branches bar(a) { if (...) { 1: b = a else { a {a, b 1 pred(b 1 ) = a stmt(b 1 ) = #1 2: a {a, b 1, b 2 b = a a {a, b 2 pred(b 2 ) = a stmt(b 2 ) = #2 3: return b 21

22 Runtime [min] Results only Class.forName Pure Forward Baseline Independent Inside-Out Maximum Heap Size [GB] 22

23 Runtime [min] Results all Caller Sensitive Methods Pure Forward Baseline Independent Inside-Out Maximum Heap Size [GB] 23

24 Two Synchronized/Dependent Analyses Caller Sensitive 24

25 Two Synchronized/Dependent Analyses Caller Sensitive Balanced Return Unbalanced Return 25

26 Runtime [min] Results only Class.forName Pure Forward Baseline Independent Inside-Out Dependent Inside-Out Maximum Heap Size [GB] 26

27 Runtime [min] Results all Caller Sensitive Methods Pure Forward Baseline Independent Inside-Out Dependent Inside-Out Maximum Heap Size [GB] 27

28 Summary 28