1. IntScope: Automatically Detecting Integer overflow vulnerability in X86 Binary Using Symbolic Execution
Tielei Wang, TaoWei, ZhingiangLin, weiZou
Purdue University and Peking University
Annapurna Sagi
Proceedings of NDSS'09: Network and Distributed System Security Symposium.

2. Contents Introduction Overview of Intscope Implementation
Evaluation and results
Strengths
Weakness

3. Introduction What is an integer overflow?
An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is too large to be represented within the available storage space.
An integer overflow occurs when an operation results in a value greater than the maximum one of the integral data type

4. Integer Overflow Example
#include <stdio.h>
Int main(void) {
Printf (“ *4= %d\n”, *4);
Return 0; }
Output= 0

5. Integer Overflow growth Vulnerabilities
Year
2000
2001
2002
2003
2004
2005
2006
2007
Num 1 2 5 29 40 66 96
124

6. Features of Integer Overflow.
Untrusted Source
Various types of sinks
Memory allocation
Memory access
Branch statement
Incomplete or improper sanitization checks

7. Unsigned int x=read_int()------> If(x>oxfffff)------> Abort(); Unsigned int n= x*sizeof(int);--> Char*p=malloc(n)--> Read_int_into_buf(p,x)---->
An Untrusted source
Incomplete check
Integer Overflow
Sensitive operator
Heap Overflow

8. Idea of IntScope
Symbolically executing the x86 Binary on an intermediate representation.
Using Taint analysis
Using Lazy Checking

9. Overview of IntScope

10. Pre-Process procedure
De compiler
Translate it into Intermediate Representation (PANDA)
Constructs the control flow graph (G) and call graph (C)
Component Extractor
Extract from C the candidate functions that are common ancestors connecting source to a sink
Profile Constructor
Computes a chop flow graph G’ based on G, that includes only source-sink paths in candidate sub-graphs.

11. Detection Procedure Symbolically execute each path in the components
Collect path constraints, and check the feasibility of the path (constraint solver)
Track the propagation of untrusted (tainted) data
Only check whether untrusted data causes integer overflows at sink points

12. Implementation

13. Chopping the CFG G in to G’

14. Symbolic Execution

15. L1 x=y=read_from_net()
L2 if(x==c)
L3 p=malloc(y);

16. Evaluation and Results
Detected integer overflow bugs in Windows DLLs
Detected bugs in several widely used applications
Media player
VLC

18. Strengths
A systematic method of combining taint analysis and path-sensitive symbolic execution to detect integer overflow vulnerabilities in executable.
A prototype called IntScope to analyze real-world binaries, which shows the approach is highly effective

19. Weakness
Lack of information on global variables may lead to false positives
Lack of information on intrinsic constraints between inputs leads to false positives.
No accurately simulation of block memory functions

20. Thank you…!!