基于代码审计技术的OpenSSL脆弱性分析

Vulnerability Analysis of OpenSSL Based on Code Audit Technology

本文讨论应用代码审计技术,分析OpenSSL源代码,进行脆弱性分析,并作出针对性修补建议.在进行源码级分析时,主要采用数据流分析技术,动态污点分析技术,定理证明等.各类代码审计技术由于都主要采用形式化手段分析软件构架的安全需求,通常都对某种特定场景有较好效果,但实用性较差.在审计linux,xen等大型成熟软件项目时,存在效率低下,误报率高等缺陷,甚至可能根本无法挖掘出有效漏洞.为此通过采用搭配使用各种不同代码审计技术,同时使用一种新的安全属性定义手法,从底层角度定义安全属性,以提升其对软件安全需求描述的准确度,避免其审计缺陷.在保留代码审计技术自动化程度高的优点同时提升其审计效率以及降低误报率,深层次发掘代码脆弱性.

This paper discusses the process of applying code audit to analyze the vulnerabilities of OpenSSL source codes and proposes some specific fixing advice for OpenSSL. Source level analysis mainly contains data flow analysis, dynamic taint analysis and path constraint solving proof method, etc. Because various code audit techniques adopt formal analysis on software architecture based on their own security requirements, they usually produce good effects when aiming at some particular scenes, but they lack universality. When auditing important mature projects like linux and xen, it is even impossible to exploit vulnerabilities efficiently with using these code audit techniques with high false rate. In this case, the collocation use of different code audit techniques is applied, as well as a new method of the security attributes definition from the bottom to improve the accuracy of software security requirements description and to avoid the defects in its audit. These methods increase audit efficiency, decrease false positive and process deep vulnerability exploitation while retaining the advantages of the high degree of automation of code audit.