Inferring Patterns for Taint-Style Vulnerabilities With Security Patches

Taint-style vulnerabilities can damage the service provided by mobile seriously. The pattern-based method is a practical way to detect taint-style vulnerabilities. Most of the methods extract the vulnerability patterns from the code base, however, sometimes missing the vulnerability patterns and resulting in some vulnerabilities undiscovered. The security patches contain valuable information about the vulnerabilities. To compensate for the inherent incompleteness of pattern matching, in this paper, we propose an approach to infer patterns with the security information carried on the security patches. The taint-style vulnerability is described as a 3-tuples <inline-formula> <tex-math notation="LaTeX">$(S_{src},S_{san},S_{sink})$ </tex-math></inline-formula> here, which consist of sources<inline-formula> <tex-math notation="LaTeX">$(S_{src})$ </tex-math></inline-formula>, sanitization <inline-formula> <tex-math notation="LaTeX">$(S_{san})$ </tex-math></inline-formula>, and sinks<inline-formula> <tex-math notation="LaTeX">$(S_{sink})$ </tex-math></inline-formula>. For each pair of vulnerable and patched programs, we extract the sanitizations from the changes between the vulnerable code and corresponding patches, infer the sinks with the impact analysis, and determine the sources through the backward traversal on the control flow graph. Finally, the complete-linkage clustering method is applied to the extracted triples to summary the patterns. We evaluate our method with open source projects. The results show our method is effective: 1) our method infers vulnerability patterns for taint-style vulnerabilities; 2) compared with the method inferring patterns from the code base, new patterns are discovered; and 3) the inferred patterns are applied to search the similar vulnerabilities successfully.