Buffer overflow vulnerability detection and patch generation system and method

1. A computer-implemented method comprising:

identifying a buffer overflow vulnerability in a vulnerable program comprising:

identifying a victim buffer creation site that created a victim buffer; and

identifying a vulnerability site that overflowed said victim buffer; and

creating a patch for said vulnerable program to prevent said vulnerability site from overflowing a potential victim buffer created by said victim buffer creation site comprising:

maintaining a potential victim buffer address map comprising said potential victim buffer;

using said potential victim buffer address map to determine whether a buffer being written to by a write instruction is said potential victim buffer;

creating a progress map entry in a progress map upon a determination that said buffer being written to by said write instruction is said potential victim buffer;

saving an address range of said potential victim buffer in said progress map entry;

saving a target memory address of said write instruction in said progress map entry;

saving a current access stride in said progress map entry;

determining that said target memory address is outside of said address range of said potential victim buffer; and

determining whether said current access stride is equal to a last access stride.

2. The computer-implemented method of claim 1 wherein said identifying a buffer overflow vulnerability in a vulnerable program further comprises emulating an instruction of said vulnerable program.

3. The computer-implemented method of claim 2 wherein said identifying a buffer overflow vulnerability in a vulnerable program further comprises determining whether a buffer is allocated during said emulating an instruction.

4. The computer-implemented method of claim 2 wherein, upon a determination that a buffer is allocated during said emulating an instruction, said identifying a buffer overflow vulnerability in a vulnerable program further comprising updating an allocated buffer versus instruction map with said buffer and said instruction that allocated said buffer.

5. The computer-implemented method of claim 4 wherein said identifying a victim buffer creation site that created a victim buffer is performed using said allocated buffer versus instruction map.

6. The computer-implemented method of claim 2 wherein said identifying a buffer overflow vulnerability in a vulnerable program further comprises determining whether a memory location is modified during said emulating an instruction.

7. The computer-implemented method of claim 6 wherein, upon a determination that a memory location is modified during said emulating an instruction, said identifying a buffer overflow vulnerability in a vulnerable program further comprises updating a modified memory locations versus modifying instructions map with said modified memory location and said instruction that modified said memory location.

8. The computer-implemented method of claim 7 wherein said identifying a vulnerability site that overflowed said victim buffer is performed using said modified memory locations versus modifying instructions map.

9. The computer-implemented method of claim 2 wherein said identifying a buffer overflow vulnerability in a vulnerable program further comprises determining whether said instruction is a return.

10. The computer-implemented method of claim 9 wherein, upon a determination that said instruction is a return, said identifying a buffer overflow vulnerability in a vulnerable program further comprising determining whether a control sensitive data structure (CSDS) is corrupted.

11. The computer-implemented method of claim 10 , wherein upon a determination that said CSDS is corrupted, said identifying a buffer overflow vulnerability in a vulnerable program comprising said identifying a victim buffer creation site that created a victim buffer and said identifying a vulnerability site that overflow said victim buffer.

12. The computer-implemented method of claim 11 wherein said identifying a buffer overflow vulnerability in a vulnerable program further comprises identifying said victim buffer.

13. The computer-implemented method of claim 1 wherein said identifying a buffer overflow vulnerability in a vulnerable program comprises running an exploit against said vulnerable program in an emulated environment.

14. The computer-implemented method of claim 1 wherein upon a determination that said current access stride is equal to said last access stride, said creating a patch for said vulnerable program further comprises taking protective action.

15. A computer system comprising:

a memory having stored therein a buffer overflow vulnerability detection and patch generation application; and

a processor coupled to said memory, wherein execution of said buffer overflow vulnerability detection and patch generation application generates a method comprising:

identifying a buffer overflow vulnerability in a vulnerable program comprising:

identifying a victim buffer creation site that created a victim buffer; and

identifying a vulnerability site that overflowed said victim buffer; and

creating a patch for said vulnerable program to prevent said vulnerability site from overflowing a potential victim buffer created by said victim buffer creation site comprising:

maintaining a potential victim buffer address map comprising said potential victim buffer;

using said potential victim buffer address map to determine whether a buffer being written to by a write instruction is said potential victim buffer;

creating a progress map entry in a progress map upon a determination that said buffer being written to by said write instruction is said potential victim buffer;

saving an address range of said potential victim buffer in said progress map entry;

saving a target memory address of said write instruction in said progress map entry;

saving a current access stride in said progress map entry;

determining that said target memory address is outside of said address range of said potential victim buffer; and

determining whether said current access stride is equal to a last access stride.

16. A computer-program product comprising a tangible computer readable non-transitory storage medium containing computer program code comprising:

a buffer overflow vulnerability detection and patch generation application for identifying a buffer overflow vulnerability in a vulnerable program comprising:

identifying a victim buffer creation site that created a victim buffer; and

identifying a vulnerability site that overflowed said victim buffer; and

said buffer overflow vulnerability detection and patch generation application further for creating a patch for said vulnerable program to prevent said vulnerability site from overflowing a potential victim buffer created by said victim buffer creation site comprising:

maintaining a potential victim buffer address map comprising said potential victim buffer;

using said potential victim buffer address map to determine whether a buffer being written to by a write instruction is said potential victim buffer;

creating a progress map entry in a progress map upon a determination that said buffer being written to by said write instruction is said potential victim buffer;

saving an address range of said potential victim buffer in said progress map entry;

saving a target memory address of said write instruction in said progress map entry;

saving a current access stride in said progress map entry;

determining that said target memory address is outside of said address range of said potential victim buffer; and

determining whether said current access stride is equal to a last access stride.