Please use this identifier to cite or link to this item:
Title: Characterizing Buffer Overflow Vulnerabilities in Large C/C++ Projects
Authors: Pereira, Jose D'Abruzzo 
Ivaki, Naghmeh 
Vieira, Marco 
Keywords: Software security; buffer over flow; static code analysis; vulnerability detection; orthogonal defect classification (ODC); software metrics
Issue Date: 2021
Project: FCT - 2020.04503.BD 
Project METRICS through FCT under Grant POCI-01-0145-FEDER-032504, in part by the Project ``AIDA Adaptive, Intelligent and Distributed Assurance Platform'' co- nanced by the European Regional Development Fund (ERDF) and COMPETE 2020 under Grant POCI-01-0247-FEDER-045907, and in part by FCT under Carnegie Mellon University (CMU) Portugal. 
Serial title, monograph or event: IEEE Access
Volume: 9
Abstract: Security vulnerabilities are present in most software systems, especially in projects with a large codebase, with several versions over the years, developed by many developers. Issues with memory management, in particular buffer over ow, are among the most frequently exploited vulnerabilities in software systems developed in C/CCC. Nevertheless, most buffer over ow vulnerabilities are not detectable by vulnerability detection tools and static analysis tools (SATs). To improve vulnerability detection, we need to better understand the characteristics of such vulnerabilities and their root causes. In this study, we analyze 159 vulnerable code units from three representative projects (i.e., Linux Kernel, Mozilla, and Xen). First, the vulnerable code is characterized using the Orthogonal Defect Classi cation (ODC), showing that most buffer over ow vulnerabilities are related to missing or incorrect checking (e.g., missing if construct around statement or incorrect logical expression used as branch condition). Then, we run two widely used C/CCC Static Analysis Tools (SATs) (i.e., CppCheck and Flaw nder) on the vulnerable and neutral (after the vulnerability x) versions of each code unit, showing the low effectiveness of this type of tool in detecting buffer over ow vulnerabilities. Finally, we characterize the vulnerable and neutral versions of each code unit using software metrics, demonstrating that, although such metrics are frequently used as indicators of software quality, there is no clear correlation between them and the existence of buffer over ow in the code. As a result, we highlight a set of observations that should be considered to improve the detection of buffer over ow vulnerabilities.
ISSN: 2169-3536
DOI: 10.1109/ACCESS.2021.3120349
Rights: openAccess
Appears in Collections:I&D CISUC - Artigos em Revistas Internacionais

Files in This Item:
Show full item record


checked on Nov 17, 2022


checked on May 2, 2023

Page view(s)

checked on Sep 25, 2023


checked on Sep 25, 2023

Google ScholarTM




This item is licensed under a Creative Commons License Creative Commons