바이너리에서 Invalid Memory Access 취약점 탐지 기술 동향 연구

Abstract

According to the vulnerability risk rankings calculated by the CWE website, most of the top vulnerabilities are invalid memory access vulnerabilities such as out-of-bounds write, use-after-free, null-pointer-dereference, etc. This is because the characteristic of the memory-related vulnerability, which lacks sanitization in a data flow, satisfied the requirements of the attackers to exploit. Most of the vulnerability detection research is based on source code. However, due to many manufacturers or vendors only providing products but not source code, techniques that can detect vulnerabilities in the binary is necessary in such situations. While due to the lack of many types as in high-level languages, such as pointers, vulnerability detection in binary systems poses many challenges. In this article, we discuss such challenges for invalid memory access vulnerability detection in binary