Family-Based Vulnerability Discovery for Software Product Lines

The exploitation of software vulnerabilities by attackers can have disastrous consequences.
Discoveries like Heartbleed strikingly demonstrated that despite this grave danger, serious vulnerabilities frequently go unnoticed. This problem is exacerbated through the introduction of Software Product Lines (SPLs), highly configurable software systems that give rise to a vast array of potentially vulnerable software products. Applying conventional static source code analysis solutions, which are a
common aid for the discovery of vulnerabilities, to these systems faces scalability and completeness issues. To address these issues, researchers introduced the concept of family-based analyses, which aim to analyze an SPL in its entirety rather than
individual products. While family-based analyses have been proposed for various objectives, previous work dedicated to family-based vulnerability discovery has been limited. Notably, there is no solution that leverages the benefits of Query-Based Static Application Security Testing (Q-SAST), which allows vulnerability patterns to be codified into queries controlling the analysis. Corresponding tools provide many benefits and enable convenient detection of even sophisticated vulnerabilities. ... mehrIn this thesis, we propose a family-based analysis approach that leverages the benefits of Q-SAST for vulnerability discovery in SPLs. To this end, we examine and compare two strategies through which an off-the-shelf Q-SAST tool can be lifted, i.e., employed for the analysis of SPLs. Based on the results of this comparison, we lift the off-the-shelf Q-SAST tool Joern by applying the strategy of lifting by simulation. This strategy entails rewriting the variability of an SPL into a form on
which the analysis tool can operate in a process known as variability encoding. The resulting implementation is integrated into the analysis platform Vari-Joern and evaluated on three real-world SPLs with regard to its effectiveness in identifying potential vulnerabilities and its overall efficiency. The results showcase promising effectiveness while also demonstrating high overall efficiency. However, they also indicate that the success of lifting by simulation hinges on the availability of high-quality variability-encoding solutions. In this regard, existing state-of-the-art tooling exhibits considerable room for improvement.