APISan: Sanitizing API Usages through Semantic Cross-Checking
summary
APISan automatically infers correct API usage by mining semantic patterns from code, building relaxed symbolic execution abstractions (api calls, arguments, constraints) and running four lightweight checkers including return-value checker and causality checker. It analyzes large codebases (92M LOC, Linux kernel and OpenSSL), reports ranked minority usages, and finds 76 previously unknown bugs with patches supplied. Implementation is ~9K LOC plus ~1K lines of Python for checkers; it reduces some false positives but has >80% false positive rate on raw reports and can take >12 hours on kernel-scale analysis.
AI-written summary · about
chapters (33)
- 0:00Intro
- 1:10Complex APls result in programmers' mistakes
- 1:58Problem: API misuse can cause security problems
- 2:23Today's practices to help programmers
- 4:36Our approach is very promising
- 4:48Technical Challenges
- 5:07Example: OpenSSL API uses
- 5:58Example: a correct implementation using OpenSSL API
- 6:32Example: providing various implementations using OpenSSL
- 7:16API usages are different from each other
- 7:47subtle semantics of the correct API usages
- 8:15Large, complex code using APIs
- 8:57Overview of APISan
- 11:48Examples: Building per-path symbolic abstractions from source code
- 13:26Return value
- 13:51Arguments
- 14:19Causality
- 14:56Extract contexts from symbolic abstractions
- 15:29Example: extract condition contexts from symbolic abstractions
- 16:28Example: find majority & minority usages from contexts
- 17:00False positives can be happened in majority analysis
- 18:04Ranking can mitigate false positives
- 18:57Our approach is formalized as a general framework
- 19:13Implementation of APISan
- 19:42Evaluation questions
- 19:59APISan is effective in finding bugs
- 20:28APISan is easy to use without any manual annotation
- 20:48APISan is easy to extend
- 21:35Check integer overflow with APISan
- 22:13APISan's ranking system is effective
- 23:13Limitation
- 23:53Conclusion
- 24:17Thank you!
related talks
16mSEMSAN: a Configurable Sanitizer for Detecting System-Level Semantic Bugs
14mSANRAZOR: Reducing Redundant Sanitizer Checks in C/C++ Programs
01h 02mSanitize your C++ code
15mAPIfix: Output-Oriented Program Synthesis for Combating Breaking Changes in Libraries
32mPractical Implementation & Automation of APISBOMs
14mGoing beyond AppSec integration, correlation, and orchestration
24mAPI security, mitigate API abuses using machine learning
42mContemporary Automatic Program Analysis