Different is Good: Detecting the Use of Uninitialized Variables through Differential Replay

摘要: The use of uninitialized variables is a common issue. It could cause kernel information leak, which defeats the widely deployed security defense, i.e., address space layout randomization (KASLR). Though recent system called Bochspwn Reloaded reported multiple memory leaks in Windows kernels, how to effectively detect this issue still largely behind. In paper, we propose new technique, differential replay, that variables. Specifically, it records and replays program's execution instances. One instance with vanilla memory, other one changes (or poisons) values allocated from stack heap. Then compares program states find references idea if variable properly initialized, will overwrite poisoned value two running instances should be same. After detecting differences, our leverages symbolic taint analysis further identify location where was allocated. This helps us root facilitate development real exploits. We have implemented prototype TimePlayer. applying both 7 10 kernels (x86/x64), successfully identified 34 issues another 85 ones had been patched (some them were publicly unknown.) Among issues, 17 confirmed as zero-day vulnerabilities by Microsoft.