Yuntong Zhang

selected publications

1. ISSTA

   Program Vulnerability Repair via Inductive Inference

   Yuntong Zhang, Xiang Gao, Gregory J. Duck, and Abhik Roychoudhury

   In Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis 2022

   Abs Bib PDF Code Video

   Program vulnerabilities, even when detected and reported, are not fixed immediately. The time lag between the reporting and fixing of a vulnerability causes open-source software systems to suffer from significant exposure to possible attacks. In this paper, we propose a counter-example guided inductive inference procedure over program states to define likely invariants at possible fix locations. The likely invariants are constructed via mutation over states at the fix location, which turns out to be more effective for inductive property inference, as compared to the usual greybox fuzzing over program inputs. Once such likely invariants, which we call patch invariants, are identified, we can use them to construct patches via simple patch templates. Our work assumes that only one failing input (representing the exploit) is available to start the repair process. Experiments on the VulnLoc data-set of 39 vulnerabilities, which has been curated in previous works on vulnerability repair, show the effectiveness of our repair procedure. As compared to proposed approaches for vulnerability repair such as CPR or SenX which are based on concolic and symbolic execution respectively, we can repair significantly more vulnerabilities. Our results show the potential for program repair via inductive constraint inference, as opposed to generating repair constraints via deductive/symbolic analysis of a given test-suite.

   @inproceedings{vulnfix,
     video = {https://www.youtube.com/watch?v=w-3wa-ecEaM},
     author = {Zhang, Yuntong and Gao, Xiang and Duck, Gregory J. and Roychoudhury, Abhik},
     title = {Program Vulnerability Repair via Inductive Inference},
     year = {2022},
     isbn = {9781450393799},
     publisher = {Association for Computing Machinery},
     address = {New York, NY, USA},
     url = {https://doi.org/10.1145/3533767.3534387},
     doi = {10.1145/3533767.3534387},
     booktitle = {Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis},
     pages = {691–702},
     numpages = {12},
     keywords = {Automated program repair, Snapshot fuzzing, Inductive inference},
     location = {Virtual, South Korea},
     series = {ISSTA 2022}
   }

2. EuroSys

   Hardening Binaries against More Memory Errors

   Gregory J. Duck, Yuntong Zhang, and Roland H. C. Yap

   In Proceedings of the Seventeenth European Conference on Computer Systems 2022

   Abs Bib PDF Code

   Memory errors, such as buffer overflows and use-after-free, remain the root cause of many security vulnerabilities in modern software. The use of closed source software further exacerbates the problem, as source-based memory error mitigation cannot be applied. While many memory error detection tools exist, most are based on a single error detection methodology with resulting known limitations, such as incomplete memory error detection (redzones) or false error detections (low-fat pointers). In this paper we introduce RedFat, a memory error hardening tool for stripped binaries that is fast, practical and scalable. The core idea behind RedFat is to combine complementary error detection methodologies—redzones and low-fat pointers—in order to detect more memory errors that can be detected by each individual methodology alone. However, complementary error detection also inherits the limitations of each approach, such as false error detections from low-fat pointers. To mitigate this, we introduce a profile-based analysis that automatically determines the strongest memory error protection possible without negative side effects.We implement RedFat on top of a scalable binary rewriting framework, and demonstrate low overheads compared to the current state-of-the-art. We show RedFat to be language agnostic on C/C++/Fortran binaries with minimal requirements, and works with stripped binaries for both position independent/dependent code. We also show that the RedFat instrumentation can scale to very large/complex binaries, such as Google Chrome.

   @inproceedings{redfat,
     author = {Duck, Gregory J. and Zhang, Yuntong and Yap, Roland H. C.},
     title = {Hardening Binaries against More Memory Errors},
     year = {2022},
     isbn = {9781450391627},
     publisher = {Association for Computing Machinery},
     address = {New York, NY, USA},
     url = {https://doi.org/10.1145/3492321.3519580},
     doi = {10.1145/3492321.3519580},
     booktitle = {Proceedings of the Seventeenth European Conference on Computer Systems},
     pages = {117–131},
     numpages = {15},
     keywords = {static binary rewriting, low-fat pointers, use-after-free, binary instrumentation, buffer overflows, memory errors, redzones, memory safety, binary hardening},
     location = {Rennes, France},
     series = {EuroSys '22}
   }