Characterizing Buffer Overflow Vulnerabilities in Large C/C++ Projects

• Main Author: Pereira, Jose D'Abruzzo
• Publication Date: 2021
• Other Authors: Ivaki, Naghmeh, Vieira, Marco
• Format: Article
• Language: eng
• Source: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Download full: https://hdl.handle.net/10316/101176; https://doi.org/10.1109/ACCESS.2021.3120349
• topic: Software security; buffer over flow; static code analysis; vulnerability detection; orthogonal defect classification (ODC); software metrics

Security vulnerabilities are present in most software systems, especially in projects with a large codebase, with several versions over the years, developed by many developers. Issues with memory management, in particular buffer over ow, are among the most frequently exploited vulnerabilities in software systems developed in C/CCC. Nevertheless, most buffer over ow vulnerabilities are not detectable by vulnerability detection tools and static analysis tools (SATs). To improve vulnerability detection, we need to better understand the characteristics of such vulnerabilities and their root causes. In this study, we analyze 159 vulnerable code units from three representative projects (i.e., Linux Kernel, Mozilla, and Xen). First, the vulnerable code is characterized using the Orthogonal Defect Classi cation (ODC), showing that most buffer over ow vulnerabilities are related to missing or incorrect checking (e.g., missing if construct around statement or incorrect logical expression used as branch condition). Then, we run two widely used C/CCC Static Analysis Tools (SATs) (i.e., CppCheck and Flaw nder) on the vulnerable and neutral (after the vulnerability x) versions of each code unit, showing the low effectiveness of this type of tool in detecting buffer over ow vulnerabilities. Finally, we characterize the vulnerable and neutral versions of each code unit using software metrics, demonstrating that, although such metrics are frequently used as indicators of software quality, there is no clear correlation between them and the existence of buffer over ow in the code. As a result, we highlight a set of observations that should be considered to improve the detection of buffer over ow vulnerabilities.