Firmware Verification

A computer program product comprising a non-transitory computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method including:

• obtaining a list of libraries utilized by a firmware;
• determining a set of vulnerabilities of the firmware based on a vulnerabilities database, wherein the vulnerabilities database comprises known vulnerabilities of libraries, wherein said determining comprises identifying in the vulnerabilities database vulnerabilities corresponding to each library of the list of libraries;
• determining a set of remedial actions for the set of vulnerabilities, wherein each remedial action of the set of remedial actions is associated with at least one of an estimated cost and estimated runtime overhead, wherein the set of remedial actions comprises a remedial action that is adapted to remedy at least two vulnerabilities of the firmware, wherein the set of remedial actions comprises at least two alternative remedial actions for a vulnerability of the firmware, wherein the set of remedial actions comprises an offline remedial action and an online remedial action, wherein the offline remedial action is a remedial action that fixes a first vulnerability in the firmware prior to an execution of the firmware, wherein the online remedial action is a remedial action performed by a runtime component that protects the firmware from an exploitation of a second vulnerability during the execution of the firmware;
• determining for the set of vulnerabilities a combination of remedial actions of the set of remedial actions, wherein the combination of remedial actions is determined based on estimated costs and estimated runtime overheads of the set of remedial actions;
• and
• providing an output based on the combination of remedial actions.

A computerized apparatus having a processor and memory, the processor being adapted to perform the steps of:

• obtaining a list of libraries utilized by a firmware;
• determining a set of vulnerabilities of the firmware based on a vulnerabilities database, wherein the vulnerabilities database comprises known vulnerabilities of libraries, wherein said determining comprises identifying in the vulnerabilities database vulnerabilities corresponding to each library of the list of libraries;
• determining a set of remedial actions for the set of vulnerabilities, wherein each remedial action of the set of remedial actions is associated with at least one of an estimated cost and estimated runtime overhead, wherein the set of remedial actions comprises a remedial action that is adapted to remedy at least two vulnerabilities of the firmware, wherein the set of remedial actions comprises at least two alternative remedial actions for a vulnerability of the firmware, wherein the set of remedial actions comprises an offline remedial action and an online remedial action, wherein the offline remedial action is a remedial action that fixes a first vulnerability in the firmware prior to an execution of the firmware, wherein the online remedial action is a remedial action performed by a runtime component that protects the firmware from an exploitation of a second vulnerability during the execution of the firmware;
• determining for the set of vulnerabilities a combination of remedial actions of the set of remedial actions, wherein the combination of remedial actions is determined based on estimated costs and estimated runtime overheads of the set of remedial actions;
• and
• providing an output based on the combination of remedial actions.