What IF Is Not Enough? Fixing Null Pointer Dereference With Contextual Check

What IF Is Not Enough? Fixing Null Pointer Dereference With Contextual Check

Speakers: Yunlong Xing, George Mason University; Qi Li

Conference: USENIX Security '24

YouTube: https://www.youtube.com/watch?v=Ef3a00Cn4g0

Overview

Null Pointer Dereference (NPD) is a pervasive and critical class of software vulnerabilities that occurs when a program attempts to access memory via a null pointer. This operation almost invariably leads to a program crash, often manifesting as a segmentation fault. When exploited by malicious actors, NPDs can have severe consequences, ranging from Denial of Service (DoS) and resource leakage to arbitrary code execution and system-wide crashes. The talk, "What IF Is Not Enough? Fixing Null Pointer Dereference With Contextual Check," presented by Yunlong Xing from George Mason University, introduces CONK, a novel approach designed to generate more accurate patches for NPD errors by incorporating valuable contextual information that prior automated patching techniques often overlook.

Traditional approaches to fixing NPDs typically follow a "generate and validate" paradigm, where potential fixes are proposed and then tested against existing test cases. Specifically, methods like VFix reduce the search space by employing predefined fixing patterns, such as simply adding an if check to determine if a variable is null and, if so, interrupting execution. While effective in basic scenarios, this talk argues that such conventional solutions frequently fail to consider the broader context surrounding the NPD, leading to incorrect or incomplete patches. CONK aims to rectify this by integrating a deeper understanding of the program's state, resource management, and inter-procedural data flow into the patch generation process, thereby significantly improving the correctness and robustness of automated NPD fixes.

Background

▶ Watch: Introduction to NPD and limitations of existing fixes (0:00)

The problem of Null Pointer Dereference has long plagued software development, consistently appearing in lists of critical vulnerabilities. Early attempts at automated patching often focused on simple, localized fixes. Tools like VFix pioneered the use of "if checks" – a straightforward approach where a check is inserted before a dereference to ensure the pointer is not null. If the pointer is indeed null, the program flow is typically diverted, often by returning from the function. While this mitigates the immediate crash, it frequently overlooks crucial side effects and program state changes that are essential for maintaining correct program behavior.

The speaker highlights several critical shortcomings of these state-of-the-art (SOTA) approaches through compelling examples. First, many existing solutions fail to account for in-procedure state retrogression. For instance, if memory has been allocated or a lock acquired within a procedure before an NPD occurs, simply returning on a null check leaves these resources unreleased, leading to memory leaks or deadlocks. Traditional methods focus solely on preventing the dereference, missing the broader implications of resource occupation. Second, prior work often neglects the need for function argument resetting. If a function modifies an argument that is then passed back to a caller, and an NPD causes an early exit, the caller might receive an un-reset argument, leading to "chaos logic" or incorrect subsequent operations. The function's schedule in the caller might then operate abnormally due to this unhandled state. Third, for void functions, a simple return might prevent the crash but propagate the vulnerability. If a memory allocation fails within a void function, and the function simply returns, the calling function might proceed as if the allocation succeeded, potentially leading to further errors down the line, as the failure state is not properly communicated or handled. These examples underscore the necessity of a more holistic, context-aware approach to NPD patching.

Key Findings

▶ Watch: Introducing CONK: A new approach for accurate NPD patches (3:30)

The central contribution of this research is the proposal of CONK (Contextual Check), a novel framework designed to generate accurate patches for Null Pointer Dereference errors by meticulously considering contextual information. CONK's key insight is that effective NPD patching extends beyond merely inserting a null check; it requires a deep understanding of the program's state, resource management, and inter-procedural data flow.

CONK specifically addresses three critical contextual aspects that previous SOTA approaches ignored:

1. In-procedure State Retrogression: Ensuring that local resources, such as allocated memory and acquired locks, are properly released or reverted to a safe state when an NPD-induced early exit occurs.
2. Function Argument Resetting: Guaranteeing that function arguments, particularly those passed by reference or modified within the function, are reset to appropriate values before the program exits or returns prematurely due to an NPD. This prevents the propagation of inconsistent states to calling functions.
3. Calling Assessment (Coaching Assessment): For void functions, assessing the impact of an early return on the calling context to prevent the vulnerability from silently propagating and causing issues further up the call stack.

The evaluation results demonstrate CONK's superior performance compared to existing automated repair tools. When tested on a dataset of 80 real-world NPD vulnerabilities identified from CVE records, CONK successfully generated 68 correct patches, with only 12 incorrect ones. This represents an 85% success rate, significantly outperforming SOTA approaches, which achieved over 26% fewer correct patches. Furthermore, on 18 NPD errors from the Defect4J benchmark, CONK generated 16 correct patches, demonstrating its effectiveness across different types of software. These findings solidify CONK's position as a more robust and accurate solution for automated NPD vulnerability patching, highlighting the critical role of contextual understanding in software repair.

Technical Deep Dive

▶ Watch: CONK's key insight: path-sensitive fixing position selection (5:27)

CONK's robust architecture is structured around four main steps, meticulously designed to incorporate contextual information into the patch generation process: NPD Context Graph Construction, Path-Sensitive Fixing Position Selection, Initial Patch Generation, and Final Patch Determination.

1. NPD Context Graph Construction

The foundation of CONK's analysis is the construction of a comprehensive NPD Context Graph. This graph models the program's control flow and data dependencies relevant to the NPD.

• Intra-procedure CFG and One-Hop CIF Function: Initially, CONK constructs an intra-procedure Control Flow Graph (CFG) for the vulnerable program. To capture relevant inter-procedural context without excessive complexity, it extends this with a "one-hop CIF function," which includes direct callers and callees. This scope is chosen as it covers most real-world vulnerability cases, with the option for incremental analysis if broader context is needed.
• Separation Logic for Localization: To precisely identify the NPD, CONK applies separation logic rules. These rules help localize the error by determining where a pointer becomes null and where the dereference triggering the error occurs. Key rules include:
• Load Error: Invalid memory is loaded.
• Load Null: A null pointer is loaded.
• Store Error: Invalid memory is stored.
• Store Null: A null pointer is stored.

By applying these rules, CONK identifies the null position (where the pointer becomes null) and the error position (where the dereference is triggered).

• Simplified CFG and Inter-procedure CG: The obtained CFG is then simplified by excluding statements irrelevant to the path between the null and error positions. Finally, an inter-procedure Control Graph is constructed by merging relevant statements and their call functions, providing a holistic view of the execution path leading to the NPD.

2. Path-Sensitive Fixing Position Selection

Once the null and error positions are identified, CONK determines the optimal repair position. The key insight here is to fix the vulnerability effectively while avoiding redundant or duplicated repair operations. CONK categorizes NPD scenarios into four distinct cases based on the multiplicity of null and error positions:

• One Null, One Error: The simplest case, where a single null assignment leads to a single dereference error.
• Multi-Null, One Error: Multiple paths can lead to a null pointer, but only one specific dereference causes the crash.
• One Null, Multi-Error: A single null pointer can be dereferenced multiple times, leading to various error points.
• Multi-Null, Multi-Error: The most complex scenario, where multiple null assignments can lead to multiple dereference errors.

CONK selects the most appropriate repair position based on these classifications to ensure efficient and non-redundant patching.

3. Initial Patch Generation

This step focuses on constructing the core repair operation, primarily focusing on if checks, which are the most common and effective in real-world NPD vulnerabilities.

• If-Condition Construction: Analyzing CVE records, CONK identifies three main types of if conditions:
• Null Check: The most common, simply checking if the pointer is NULL.
• Exception Value Check: Checking if a function's return value indicates an error (e.g., -1 for failure).
• Non-Null Check: Less common but relevant for specific contexts.

The primary task is to analyze the return value of the call function at the null position. For example, if kvmalloc_re returns a null pointer to pcpu_sum, the condition would check pcpu_sum == NULL.

• Resource Retrogression: This is a crucial contextual aspect. If an early exit occurs due to an NPD, allocated resources (memory, locks) must be released to prevent leaks or deadlocks. CONK identifies required function pairs (e.g., malloc/free, kmalloc/kfree, lock/unlock) by analyzing CVE records and open-source repositories. It collects function parameters and naming conventions to generate thousands of such pairs, enabling the automatic insertion of corresponding release operations.
• Return Statement Construction: The final part of the initial patch involves determining the correct return statement. This largely depends on the function's type:
• Boolean Type: Returns false to indicate failure.
• Void Type: Returns directly, but this is where calling assessment later becomes critical.
• Loop Exits: For NPDs within loops, continue or break statements might be required to exit the loop gracefully.

4. Final Patch Determination

After generating an initial patch, CONK refines it by conducting inter-procedure state propagation to ensure global consistency.

• Resetting Global Variables and Function Arguments: This step is vital for preventing the propagation of incorrect states. CONK identifies global variables and function arguments that might have been modified before the NPD. It then infers their expected values from the data flow in the caller function to ensure they are reset to a consistent state upon an early return. This prevents "chaos logic" in subsequent operations.
• Calling Assessment (Coaching Assessment): This step specifically addresses the challenges with void functions. While an initial patch might simply return, CONK assesses the impact of this early return on the calling function. The details of this assessment are extensive and further elaborated in the full paper, but its purpose is to ensure that an early exit from a void function does not lead to silent vulnerability propagation or incorrect behavior in the caller.

By meticulously integrating these four steps and their sub-components, CONK provides a comprehensive, context-aware framework for fixing NPD vulnerabilities, moving beyond simplistic null checks to address the broader implications of program state and resource management.

Demo / Proof of Concept

▶ Watch: Retrogressing local resources: pairing functions for memory/lock release (6:30)

While the talk did not feature a live, interactive demonstration of CONK in action, the efficacy of the proposed solution was rigorously proven through an extensive experimental evaluation. This evaluation serves as the primary proof of concept, showcasing CONK's ability to generate accurate patches for real-world Null Pointer Dereference vulnerabilities.

CONK was evaluated on two distinct datasets:

1. Real-world NPD vulnerabilities from CVE records: A collection of 80 documented NPD vulnerabilities.
2. NPD errors from the Defect4J benchmark: A standard benchmark containing 18 known NPD errors.

The performance of CONK was compared against several state-of-the-art automated program repair approaches:

• VFix: A representative SOTA approach for NPD repair, primarily using if checks.
• NPIFix: Another specialized NPD repair tool.
• SameFix: A general program repair tool.

All experiments were conducted on a machine equipped with an Intel i7 CPU and 16 GB of memory, running Ubuntu 22.04.

Evaluation Results:

• CVE Dataset: On the 80 real-world CVEs, CONK successfully generated 68 correct patches and 12 incorrect patches. This significantly outperformed SOTA approaches by over 26% in terms of correct patch generation.
• Defect4J Benchmark: For the 18 NPD errors in Defect4J, CONK generated 16 correct patches and only 2 incorrect ones, again demonstrating superior performance compared to existing solutions.

Analysis of Incorrect Patches: The 12 incorrect patches in the CVE dataset and the 2 in Defect4J were primarily attributed to semantic errors, highlighting a limitation where expert knowledge or highly specific contextual information (such as macro definitions and their relationships) was not obtainable within CONK's current analysis scope. For example, one CVE required checking if a member R_PRO of rmp was not null, but this member information was not available in CONK's context. Similarly, another CVE (CVE-2022-2874) required checking a variable against a specific macro, which CONK could not infer. These cases underscore the inherent complexity of fully automated semantic-aware patching, yet CONK's high success rate on the majority of vulnerabilities demonstrates its significant advancement in practical applicability.

Defensive Implications

▶ Watch: CONK's patch generation results and identified limitations (8:40)

CONK's research provides critical insights and actionable strategies for both software developers and security professionals engaged in defensive measures against Null Pointer Dereference vulnerabilities.

For software developers and architects, CONK emphasizes that simple null checks are often insufficient. Developers must cultivate a more holistic understanding of program state and resource management, especially in error-handling paths. When an unexpected null pointer leads to an early exit, it's not enough to merely prevent the crash; allocated memory, acquired locks, and modified function arguments must be properly handled. This includes:

• Resource Management: Implementing robust finally blocks or equivalent mechanisms to ensure resources like memory (e.g., free after malloc) and locks (e.g., unlock after lock) are always released, even during exceptional exits.
• State Consistency: Being mindful of how function arguments are passed and modified. If a function might exit prematurely, ensure that any changes to arguments are either reverted or that the calling function is prepared to handle an inconsistent state.
• Inter-procedural Awareness: Recognizing that a local fix in one function can have cascading effects on callers. For void functions, consider alternative return mechanisms (e.g., returning an error code via an output parameter) to signal failure explicitly.

For developers of automated security tools and program repair systems, CONK offers a blueprint for building more sophisticated and context-aware patching solutions. The methodology outlined by CONK—incorporating context graph construction, path-sensitive analysis, multi-stage patch generation, and inter-procedure state propagation—demonstrates that significant improvements in patch correctness are achievable. Future tools should aim to:

• Integrate rich contextual information, including data flow, control flow, and resource allocation/deallocation patterns.
• Develop more advanced techniques for identifying and pairing resource management functions.
• Enhance inter-procedural analysis to understand the impact of local fixes on global program state.
• Explore incorporating semantic understanding, potentially through machine learning or more advanced program analysis, to address the challenging cases where macro definitions or expert knowledge are currently required.

For security analysts and incident responders, understanding CONK's limitations is as important as understanding its capabilities. While automated patching is becoming more effective, it's crucial to recognize that complex semantic errors or highly context-dependent vulnerabilities may still require manual review and expert intervention. Tools based on CONK's principles can significantly reduce the workload, but they are not a panacea. Analysts should therefore leverage such tools for initial remediation but maintain a critical eye for potential subtle inconsistencies or edge cases introduced by automated patches.

In essence, CONK pushes the boundaries of automated vulnerability repair, providing a more robust framework that encourages a deeper, more contextual understanding of software vulnerabilities and their remediation.

Key Takeaways

• Null Pointer Dereference (NPD) vulnerabilities require more than simple if checks; contextual information is crucial for generating correct and complete patches.
• CONK is a novel framework that addresses NPDs by considering in-procedure state retrogression, function argument resetting, and calling assessment.
• CONK significantly outperforms state-of-the-art automated repair tools, achieving 68 correct patches out of 80 real-world CVEs and 16 out of 18 in the Defect4J benchmark.
• The CONK methodology involves four key steps: NPD context graph construction, path-sensitive fixing position selection, initial patch generation (including resource retrogression), and final patch determination (with inter-procedure state propagation).
• Limitations of current automated patching, including CONK, often stem from the inability to infer highly specific semantic information (e.g., macro definitions, expert-level domain knowledge) from the program's context.
• Developers should prioritize comprehensive resource management and state consistency in error handling, while automated tool developers can leverage CONK's principles for more sophisticated, context-aware repair systems.

About the Speaker(s)

The research presented was a collaborative effort by Yunlong Xing and Qi Li. Yunlong Xing, affiliated with George Mason University, delivered the presentation at USENIX Security '24, sharing insights into their work on enhancing the accuracy of automated Null Pointer Dereference vulnerability patching. The talk highlighted their expertise in program analysis and automated software repair techniques.