| 引用本文: | 黄宁,黄曙光,潘祖烈,等.ASLR机制脆弱性自动分析方法.[J].国防科技大学学报,2020,42(2):162-170, 185.[点击复制] |
| HUANG Ning,HUANG Shuguang,PAN Zulie,et al.Automatic analysis to vulnerability of ASLR[J].Journal of National University of Defense Technology,2020,42(2):162-170, 185[点击复制] |
|
| |
|
|
| 本文已被：浏览 7174次 下载 5538次 |
| ASLR机制脆弱性自动分析方法 |
| 黄宁,黄曙光,潘祖烈,常超 |
|
(国防科技大学 电子对抗学院, 安徽 合肥 230037)
|
| 摘要: |
| 地址随机化是一种针对控制流劫持漏洞的防御机制。已有的漏洞自动分析与利用技术缺少对地址随机化机制影响的分析,导致生成的测试用例在实际环境中的运行效果受到极大限制。针对地址随机化的缺陷及其绕过技术的特点,提出了一种地址随机化脆弱性分析方法。该方法使用有限状态机描述程序运行路径中各关键节点的状态；针对常见的内存泄漏与控制流劫持场景建立约束条件；通过求解内存泄漏状态约束与控制流劫持状态约束的兼容性,分析地址随机化机制在特定场景下的脆弱性。实验结果表明,该方法可有效检测通过内存泄漏导致的地址随机化绕过及控制流劫持攻击,实现自动化的地址随机化脆弱性分析,提高针对软件安全性分析的效率。 |
| 关键词: 地址随机化 控制流劫持 内存泄漏 有限状态机 |
| DOI：10.11887/j.cn.202002022 |
| 投稿日期：2018-10-19 |
| 基金项目:国家重点研发计划“网络空间安全”重点专项资助项目(2017YFB0802905) |
|
| Automatic analysis to vulnerability of ASLR |
| HUANG Ning, HUANG Shuguang, PAN Zulie, CHANG Chao |
|
(College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China)
|
| Abstract: |
| The ASLR (address space layout randomization) is a defense mechanism to prevent the control-flow hijack. The lack of analysis of the impact of ASLR in existed automatic vulnerability analysis and exploit technologies makes the test cases difficult to be used in actual environment. Aimed at the defects of address randomization and features of its bypass technologies, an analysis method was proposed to deal with the vulnerability of ASLR based on program states transition. The FSM (finite states machine) was used to describe the transition of each key state on the program path, the constraints for some common scenes of memory leakage and control-flow hijack were built, and the vulnerability of ASLR was analyzed by solving the compatibility of memory leakage state constraints and control-flow hijack state constraints. Experimental results show that the proposed method can effectively detect ASLR bypass and control-flow hijack attacks caused by memory leakage, realize the automatic vulnerability analysis of ASLR, and improve the efficiency of software security analysis. |
| Keywords: address space layout randomization control-flow hijack memory leakage finite states machine |
|
|
|
|
|
