Mitigating Security Risks in Linux with KLAUS – A Method for Evaluating Patch Correctness

Yuhang Wu; Zhenpeng Lin; Yueqi Chen; Dang K. Le; Dongliang Mu; Xinyu Xing

Mitigating Security Risks in Linux with KLAUS – A Method for Evaluating Patch Correctness

Yuhang Wu, Zhenpeng Lin, Yueqi Chen, Dang K. Le, Dongliang Mu, Xinyu Xing

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

2 Scopus citations

Abstract

The Linux kernel’s growth introduces daily bugs that are often detected and eliminated using code analyzers. However, creating accurate Linux patches remains challenging and poses security risks. To address this, we manually analyzed 182 incorrectly developed Linux kernel patches and discovered that the inaccuracies usually result from changes to variable read and write operations by the patch. Based on this finding, we created KLAUS, a new method for evaluating patch quality. KLAUS leverages abstract interpretation to extract modified read and write operations caused by the patch in the Linux kernel. It combines these alterations with branch-resolving mechanisms to guide a kernel fuzzer toward relevant code and contexts. Testing KLAUS on numerous real-world Linux kernel patches demonstrates its superior effectiveness and efficiency in detecting incorrectly developed patches. So far, KLAUS has identified and reported 30 incorrect patches to the Linux community, some of which could enable privilege escalation on Android and Ubuntu systems.

Original language	English (US)
Title of host publication	32nd USENIX Security Symposium, USENIX Security 2023
Publisher	USENIX Association
Pages	4247-4264
Number of pages	18
ISBN (Electronic)	9781713879497
State	Published - 2023
Event	32nd USENIX Security Symposium, USENIX Security 2023 - Anaheim, United States Duration: Aug 9 2023 → Aug 11 2023

Publication series

Name	32nd USENIX Security Symposium, USENIX Security 2023
Volume	6

Conference

Conference	32nd USENIX Security Symposium, USENIX Security 2023
Country/Territory	United States
City	Anaheim
Period	8/9/23 → 8/11/23

Funding

We thank our shepherd and other anonymous reviewers for their insightful feedback. This work was supported by grants from Defense Advanced Research Projects Agency (DARPA) under Grant No. N6600122C4026, Office of Naval Research (ONR) under Grant No. N00014-20-1-2008, and the National Science Foundation (NSF) under Grant No. 1954466, 2045948. Any opinions, findings, conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the funding agency.

ASJC Scopus subject areas

Computer Networks and Communications
Information Systems
Safety, Risk, Reliability and Quality

Cite this

@inproceedings{5882f79ee2234aa0a57492154d72eb80,

title = "Mitigating Security Risks in Linux with KLAUS – A Method for Evaluating Patch Correctness",

abstract = "The Linux kernel{\textquoteright}s growth introduces daily bugs that are often detected and eliminated using code analyzers. However, creating accurate Linux patches remains challenging and poses security risks. To address this, we manually analyzed 182 incorrectly developed Linux kernel patches and discovered that the inaccuracies usually result from changes to variable read and write operations by the patch. Based on this finding, we created KLAUS, a new method for evaluating patch quality. KLAUS leverages abstract interpretation to extract modified read and write operations caused by the patch in the Linux kernel. It combines these alterations with branch-resolving mechanisms to guide a kernel fuzzer toward relevant code and contexts. Testing KLAUS on numerous real-world Linux kernel patches demonstrates its superior effectiveness and efficiency in detecting incorrectly developed patches. So far, KLAUS has identified and reported 30 incorrect patches to the Linux community, some of which could enable privilege escalation on Android and Ubuntu systems.",

author = "Yuhang Wu and Zhenpeng Lin and Yueqi Chen and Le, {Dang K.} and Dongliang Mu and Xinyu Xing",

year = "2023",

language = "English (US)",

series = "32nd USENIX Security Symposium, USENIX Security 2023",

publisher = "USENIX Association",

pages = "4247--4264",

booktitle = "32nd USENIX Security Symposium, USENIX Security 2023",

}

Wu, Y, Lin, Z, Chen, Y, Le, DK, Mu, D & Xing, X 2023, Mitigating Security Risks in Linux with KLAUS – A Method for Evaluating Patch Correctness. in 32nd USENIX Security Symposium, USENIX Security 2023. 32nd USENIX Security Symposium, USENIX Security 2023, vol. 6, USENIX Association, pp. 4247-4264, 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, United States, 8/9/23.

Mitigating Security Risks in Linux with KLAUS – A Method for Evaluating Patch Correctness. / Wu, Yuhang; Lin, Zhenpeng; Chen, Yueqi et al.
32nd USENIX Security Symposium, USENIX Security 2023. USENIX Association, 2023. p. 4247-4264 (32nd USENIX Security Symposium, USENIX Security 2023; Vol. 6).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Mitigating Security Risks in Linux with KLAUS – A Method for Evaluating Patch Correctness

AU - Wu, Yuhang

AU - Lin, Zhenpeng

AU - Chen, Yueqi

AU - Le, Dang K.

AU - Mu, Dongliang

AU - Xing, Xinyu

PY - 2023

Y1 - 2023

N2 - The Linux kernel’s growth introduces daily bugs that are often detected and eliminated using code analyzers. However, creating accurate Linux patches remains challenging and poses security risks. To address this, we manually analyzed 182 incorrectly developed Linux kernel patches and discovered that the inaccuracies usually result from changes to variable read and write operations by the patch. Based on this finding, we created KLAUS, a new method for evaluating patch quality. KLAUS leverages abstract interpretation to extract modified read and write operations caused by the patch in the Linux kernel. It combines these alterations with branch-resolving mechanisms to guide a kernel fuzzer toward relevant code and contexts. Testing KLAUS on numerous real-world Linux kernel patches demonstrates its superior effectiveness and efficiency in detecting incorrectly developed patches. So far, KLAUS has identified and reported 30 incorrect patches to the Linux community, some of which could enable privilege escalation on Android and Ubuntu systems.

AB - The Linux kernel’s growth introduces daily bugs that are often detected and eliminated using code analyzers. However, creating accurate Linux patches remains challenging and poses security risks. To address this, we manually analyzed 182 incorrectly developed Linux kernel patches and discovered that the inaccuracies usually result from changes to variable read and write operations by the patch. Based on this finding, we created KLAUS, a new method for evaluating patch quality. KLAUS leverages abstract interpretation to extract modified read and write operations caused by the patch in the Linux kernel. It combines these alterations with branch-resolving mechanisms to guide a kernel fuzzer toward relevant code and contexts. Testing KLAUS on numerous real-world Linux kernel patches demonstrates its superior effectiveness and efficiency in detecting incorrectly developed patches. So far, KLAUS has identified and reported 30 incorrect patches to the Linux community, some of which could enable privilege escalation on Android and Ubuntu systems.

UR - http://www.scopus.com/inward/record.url?scp=85176105796&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85176105796&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:85176105796

T3 - 32nd USENIX Security Symposium, USENIX Security 2023

SP - 4247

EP - 4264

BT - 32nd USENIX Security Symposium, USENIX Security 2023

PB - USENIX Association

T2 - 32nd USENIX Security Symposium, USENIX Security 2023

Y2 - 9 August 2023 through 11 August 2023

ER -

Mitigating Security Risks in Linux with KLAUS – A Method for Evaluating Patch Correctness

Abstract

Publication series

Conference

Funding

ASJC Scopus subject areas

Other files and links

Fingerprint

Cite this