Precise and Accurate Patch Presence Test for Binaries
summary
FIBER parses open-source security patches, extracts small, high-value change sites, and translates them into fine-grained binary signatures that combine local control-flow topology and simplified semantic formulas (symbolic execution via angr) to search stripped Android/Linux kernels. It evaluates 107 real patches against 800 kernel images from three vendors, reports 94% accuracy with zero false positives, finds some patches missing for months, runs slower than purely syntactic tools, and notes false negatives from inlining and code-movement.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:59A real-world example
- 2:30#1: Needle in the changing haystack
- 3:33#2: Haystack is a binary...
- 3:46Related work
- 5:27Change Site Analysis: What will human do?
- 9:42Binary Signature Translation
- 13:03Matching
- 16:08Accuracy
- 17:44Performance
- 18:10Un-ported patches
related talks
47mAdaptive Kernel Live Patching: An Open Collaborative Effort...
49mD2T1 - Uncovering the Android Patch Gap
21mSPINFER: Inferring Semantic Patches for the Linux Kernel
27mAdaptive Android Kernel Live Patching
42mScan, Patch, VEX - Using Open Source Tools to Manage...
14mThe Power of Backports : Business Impact and Automation Strategies
33mIdentifying Multi-Binary Vulnerabilities in Embedded Firmware at Scale
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug