kirancodes.me
To Proof Maintenance & Beyond!
ASE 2019

CONVUL: An Effective Tool for Detecting Concurrency Vulnerabilities

Ruijie Meng, Biyun Zhu, Hao Yun, Haicheng Li, Yan Cai, Zijiang Yang

DOI 10.1109/ase.2019.00125dblp

Abstract

Concurrency vulnerabilities are extremely harmful and can be frequently exploited to launch severe attacks. Due to the non-determinism of multithreaded executions, it is very difficult to detect them. Recently, data race detectors and techniques based on maximal casual model have been applied to detect concurrency vulnerabilities. However, the former are ineffective and the latter report many false negatives. In this paper, we present CONVUL, an effective tool for concurrency vulnerability detection. CONVUL is based on exchangeable events, and adopts novel algorithms to detect three major kinds of concurrency vulnerabilities. In our experiments, CONVUL detected 9 of 10 known vulnerabilities, while other tools only detected at most 2 out of these 10 vulnerabilities. The 10 vulnerabilities are available at https://github.com/mryancai/ConVul.

BibTeX
@inproceedings{Meng-al:ASE19,
  author    = {Ruijie Meng and
               Biyun Zhu and
               Hao Yun and
               Haicheng Li and
               Yan Cai and
               Zijiang Yang},
  title     = {{CONVUL:} An Effective Tool for Detecting Concurrency Vulnerabilities},
  booktitle = {ASE},
  pages     = {1154--1157},
  publisher = {{IEEE}},
  year      = {2019},
}

Related papers