Path-wise Vulnerability Mitigation

TL;DR

This paper introduces PAVER, a novel approach for generating path-wise mitigation patches that target specific program paths leading to vulnerabilities, significantly reducing side-effects compared to traditional function-level patches.

Contribution

PAVER is the first method to generate and insert mitigation patches at the program path level, improving precision and minimizing side-effects.

Findings

PAVER effectively reduces side-effects of mitigation patches.

The approach successfully applied to real-world vulnerabilities.

Path-wise patches outperform function-level patches in minimizing impact.

Abstract

Software vulnerabilities are prevalent but fixing software vulnerabilities is not trivial. Studies have shown that a considerable prepatch window exists because it often takes weeks or months for software vendors to fix a vulnerability. Existing approaches aim to reduce the pre-patch window by generating and applying mitigation patches that prevent adversaries from exploiting vulnerabilities rather than fix vulnerabilities. Because mitigation patches typically terminate the execution of vulnerability-triggering program paths at the level of functions, they can have significant side-effects. This paper describes an approach called PAVER that generates and inserts mitigation patches at the level of program paths, i.e. path-wise vulnerability mitigation patches, in order to reduce their side-effects. PAVER generates a program path graph that includes the paths leading to vulnerabilities and the control dependencies on these paths, then identifies candidate patch locations based on the program path graph. For each candidate patch location, PAVER generates and inserts a mitigation patch, and tests the patched program to assess the side-effect of the patch. It ranks the patches by the extent of their side-effects. We evaluates the prototype of PAVER on real world vulnerabilities and the evaluation shows that our path-wise vulnerability mitigation patches can achieve minimum side-effects.