Back to results
US 9,317,695 B2Granted
System and method for automated remedying of security vulnerabilities
AssigneeVeracode, Inc.
InventorThomas M. Pappas
Life of this patent
Estimating the term…
Abstract
In a binary patching system for alleviating security vulnerabilities in a binary representation of a software application, a binary code portion determined to be associated with a security vulnerability is replaced with a replacement binary code that can avoid such vulnerability without substantially changing the functionality of the code portion that was replaced. The replacement binary code can be selected based on properties and/or context of the code portion to be replaced.
Claims25
A method for automatically remedying security flaws, the method comprising the steps of:
- receiving in memory a static binary analysis report for a binary file corresponding to an application, the report identifying a security flaw in a section of the binary file;
- identifying, by a processor, based on, at least in part, the received report, the section of the binary file that corresponds to the security flaw, the identified section comprising a first binary code segment providing a functionality in an unsecure manner;
- locating a matching binary patch comprising a second binary code segment providing functionality in a secure manner and matching the functionality provided by the first binary code segment in the identified section, in a library of patches, wherein at least one of:
- (i) the functionality provided by the matching binary patch comprises the functionality provided by the first binary code segment;
- and (ii) the functionality provided by the first binary code segment comprises the functionality provided by the matching binary patch;
- determining whether replacing within the binary file the identified section with the matching binary patch would result in a change in a function of the binary file;
- if no change in the function is determined to occur, replacing within the binary file the identified section with the matching patch;
- and
- otherwise generating a notification that the replacement would change the function.
6 more elements
A system comprising:
- a first processor;
- and
- a first memory coupled to the first processor, the first memory comprising instructions which, when executed by a processing unit comprising at least one of the first processor and a second processor, program the processing unit, for automatically remedying security flaws, to:
- receive in a memory module comprising at least one of the first memory and a second memory coupled to the second processor, a static binary analysis report for a binary file corresponding to an application, the report identifying a security flaw in a section of the binary file;
- identify based on, at least in part, the received report, the section of the binary file that corresponds to the security flaw, the identified section comprising a first binary code segment providing a functionality in an unsecure manner;
- locate a matching binary patch comprising a second binary code segment providing functionality in a secure manner and matching the functionality provided by the first binary code segment in the identified section, in a library of patches, wherein at least one of:
- (i) the functionality provided by the matching binary patch comprises the functionality provided by the first binary code segment;
- and (ii) the functionality provided by the first binary code segment comprises the functionality provided by the matching binary patch;
- determine whether replacing within the binary file the identified section with the matching binary patch would result in a change in a function of the binary file;
- if no change in the function is determined to occur, replace within the binary file the identified section with the matching patch;
- and
- otherwise generate a notification that the replacement would change the function.
9 more elements
An article of manufacture comprising a non-transitory storage medium having stored therein instructions which, when executed by a processor, program the processor, for automatically remedying security flaws, to:
- receive in memory coupled to the processor a static binary analysis report for a binary file corresponding to an application, the report identifying a security flaw in a section of the binary file;
- identify based on, at least in part, the received report, the section of the binary file that corresponds to the security flaw, the identified section comprising a first binary code segment providing a functionality in an unsecure manner;
- locate a matching binary patch comprising a second binary code segment providing functionality in a secure manner and matching the functionality provided by the first binary code segment in the identified section, in a library of patches, wherein at least one of:
- (i) the functionality provided by the matching binary patch comprises the functionality provided by the first binary code segment;
- and (ii) the functionality provided by the first binary code segment comprises the functionality provided by the matching binary patch;
- determine whether replacing within the binary file the identified section with the matching binary patch would result in a change in a function of the binary file;
- if no change in the function is determined to occur, replace within the binary file the identified section with the matching patch;
- and
- otherwise generate a notification that the replacement would change the function.
6 more elements
Dependencies are inferred from the claim text.