kaih@khms.westfalen.de (Kai Henningsen) wrote:
> I guess what we _really_ need is some sort of super lint. That is, a
> program that can analyze C code (others are fine, but C is the most
> important by far) and highlights problematic points in the code.
Interesting that you mention it. I've been involved in some recent work
that may help bring us a little closer to your idea of a `super lint' for
security problems (though it is not yet as mature as I'd like). The
following paper may be of interest to you -- it describes a new technique
for finding potential buffer overruns in C source code.
A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities
David Wagner, Jeffrey S. Foster, Eric A. Brewer, and Alexander Aiken.
http://www.cs.berkeley.edu/~daw/papers/overruns-ndss00.ps
To appear at NDSS 2000, Feb. 2000.
Abstract:
We describe a new technique for finding potential buffer overrun
vulnerabilities in security-critical C code. The key to success is to
use static analysis: we formulate detection of buffer overruns as an
integer range analysis problem. One major advantage of static analysis
is that security bugs can be eliminated before code is deployed.
We have implemented our design and used our prototype to find new
remotely-exploitable vulnerabilities in a large, widely deployed
software package. An earlier hand audit missed these bugs.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Sat Jan 15 2000 - 21:00:11 EST