Method and system for detecting vulnerabilities in source code
A method and system of detecting vulnerabilities in source code. Source code is parsed into an intermediate representation. Models (e.g., in the form of lattices) are derived for the variables in the code and for the variables and/or expressions used in conjunction with routine calls. The models are then analyzed in conjunction with pre-specified rules about the routines to determine if the routine call posses one or more of pre-selected vulnerabilities.
1. A computer implemented method of detecting vulnerabilities in a pre-existing source code listing, said source code listing having a listed sequence of expressions, each expression including a set of operands and operators to transform values of the operands, said listed sequence of expressions having an inherent control flow indicative of the run-time execution of the expressions and an inherent data flow indicative of the run-time transformations of operand values, said source code listing being expressed in multiple programming languages, said source code listing further having routine calls including arguments with which to invoke a routine, said source code listing being stored in a computer-readable medium, said computer implemented method comprising the acts of:
executing computer instructions to create a single intermediate representation of said source code listing regardless of programming language by parsing said source code listing;
executing computer instructions to provide a database having computer-readable records associated with pre-identified routines, each record specifying an argument vulnerability condition for arguments of said corresponding pre-identified routine, that, if satisfied, presents a vulnerability during execution of said routine;
executing computer instructions to statically analyze said intermediate representation of said source code listing to create computer models of the operands, said models representing expected transformation of the operands from run time execution of a computer program created by compilation of said source code listing, said models being stored in computer memory;
executing computer instructions said operand models to create models of said arguments to routine calls, said argument models being stored in computer memory;
executing computer instructions to retrieve, from said database, a record corresponding to routine calls represented in said intermediate representation;
executing computer instructions to compare said argument models with said condition specified in the retrieved record to determine whether the routine call possesses vulnerabilities as a consequence of the arguments; and
generating a report that identifies detected vulnerabilities, said report being viewable by a developer-user, so the developer-user may address the vulnerabilities identified in the report by modifying the source code listing if necessary.
2. The computer implemented method of claim 1 wherein the models specify the memory size of a variable.
3. The computer implemented method of claim 1 wherein the models specify the data size of a variable.
4. The computer implemented method of claim 1 wherein the models specify whether the variable is a null terminated string or not null terminated string for variables of string value type.
5. The computer implemented method of claim 1 wherein the models specify the type of memory of the variable.
6. The computer implemented method of claim 1 wherein the models specify the value of a string for variables that are of string value type.
7. The computer implemented method of claim 1 wherein the models specify the origin of the data for a variable.
8. The computer implemented method of claim 1 wherein the models are specified as lattices.
9. The computer implemented method of claim 8 wherein the lattice values include at least one of a value to represent no knowledge, a value to represent inconsistent knowledge, and a value to represent a refinement of knowledge.
10. The computer implemented method of claim 9 wherein the value to represent a refinement of knowledge includes values to specify a range of specific values.
11. The computer implemented method of claim 1 wherein the one or more conditions comprise computer-encoded rules about the semantic behavior of the routine.
12. The computer implemented method of claim 1 wherein the vulnerabilities comprise buffer overflow vulnerabilities.
13. The computer implemented method of claim 1 wherein the vulnerabilities comprise race condition vulnerabilities.
14. The computer implemented method of claim 1 wherein the vulnerabilities comprise privilege escalation vulnerabilities.
15. The computer implemented method of claim 1 wherein the report identifies the location in the source code listing where the vulnerability occurred.