GnuZero: A Compiler-Based Zeroization Static Detection Tool for the Masses
summary
GnuZero is a GCC-integrated static detector that extends the GCC Static Analyzer (GSA) with symbolic execution and region-aware state tracking to find missing zeroization for stack and heap secrets. It introduces scrub/scrubber attributes, models secret vs tainted values, and ties leaks to variable lifetime (return for stack, free for heap). Implementation modifies GSA’s S-value/region mapping, runs at late middle-end, reports via SARIF, achieves 100% Juliet detection for relevant CWEs and finds new issues in libsodium, Linux crypto modules and WPA supplicant.
AI-written summary · about
chapters (9)
- 0:00GNUZero introduction
- 1:47Zeroization in security
- 3:33Manual zeroization challenges
- 4:37GNUZero with GCC analyzer
- 6:02Symbolic execution tracking
- 9:34Leakage model for variables
- 12:29Testing on real codebases
- 13:54Compile-time overhead
- 14:17Q&A
related talks
14mStatic Analysis for Zero-Knowledge Programming Languages
44mWhere are we on security features?
03mdisplays breadth of security, safety, and static analysis
27mDead Store Elimination (Still) Considered Harmful
35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel
32mApplied static firmware analysis in a CI environment for increased safety and code review insights
01h 00mSanitize for your Sanity: Sanitizers tools for Modern C++
24mSNIP: Speculative Execution and Non-Interference Preservation for Compiler(…)