System and method for automated remedying of security vulnerabilities
AssigneeVeracode, Inc.
InventorThomas M. Pappas
Life of this patent
Estimating the term…
Abstract
In a binary patching system for alleviating security vulnerabilities in a binary representation of a software application, a binary code portion determined to be associated with a security vulnerability is replaced with a replacement binary code that can avoid such vulnerability without substantially changing the functionality of the code portion that was replaced. The replacement binary code can be selected based on properties and/or context of the code portion to be replaced.
Claims27
A method for automatically remedying security flaws, the method comprising the steps of:
- receiving in memory a static binary analysis report for a binary file corresponding to an application;
- identifying a section of the binary file, by a processor, based on, at least in part, the received report, the identified section corresponding to a security flaw;
- determining if a binary patch matching with the identified section exists in a library of patches;
- if the matching patch is determined to exist, determining if replacing the identified section with the matching binary patch would result in a change in a function of the binary file;
- if no change in the function is determined to occur, replacing the identified section with the matching patch;
- and
- generating a notification if the library lacks the matching binary patch or if the replacement would change the function.
A system comprising:
- a first processor;
- and
- a first memory coupled to the first processor, the first memory comprising instructions which, when executed by a processing unit comprising at least one of the first processor and a second processor, program the processing unit, for automatically remedying security flaws, to:
- receive in a memory module comprising at least one of the first memory and a second memory coupled to the second processor, a static binary analysis report for a binary file corresponding to an application;
- identify a section of the binary file based on, at least in part, the received report, the identified section corresponding to a security flaw;
- determine if a binary patch matching with the identified section exists in a library of patches;
- if the matching patch is determined to exist, determine if replacing the identified section with the matching binary patch would result in a change in a function of the binary file;
- if no change in the function is determined to occur, replace the identified section with the matching patch;
- and
- generate a notification if the library lacks the matching binary patch or if the replacement would change the function.
An article of manufacture comprising a non-transitory storage medium having stored therein instructions which, when executed by a processor, program the processor, for automatically remedying security flaws, to:
- receive in memory coupled to the processor a static binary analysis report for a binary file corresponding to an application;
- identify a section of the binary file based on, at least in part, the received report, the identified section corresponding to a security flaw;
- determine if a binary patch matching with the identified section exists in a library of patches;
- if the matching patch is determined to exist, determine if replacing the identified section with the matching binary patch would result in a change in a function of the binary file;
- if no change in the function is determined to occur, replace the identified section with the matching patch;
- and
- generate a notification if the library lacks the matching binary patch or if the replacement would change the function.
Dependencies are inferred from the claim text.