4 ms·

Do you know why/if a sanitizer is not enough to catch these bugs at runtime (and during their automated tests)?

by mk89 4y ago

saagarjha 4y ago
Google invests heavily in sanitizers. It funded the development of the ones that ship with LLVM.
- mk89 4y ago
  Yes, I know. My question was more if or why a sanitizer doesn't help.
  - pjmlp 4y ago
    Not always, see https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html https://googleprojectzero.blogspot.com/2021/12/this-shouldnt...
    - mk89 4y ago
      My understanding though is that the ASAN would have done its job, had the test checked for the results. Quoting from the post: > This fuzzer might have produced a SECKEYPublicKey that could have reached the vulnerable code, but as the result was never used to verify a signature, the bug could never be discovered. If the result had been used, the ASAN would have kicked in, I guess, or?
      - pjmlp 4y ago
        Well, it is a lot of conditionals, and in any case binaries are seldom shipped with ASAN into production, so it would still be a lottery outcome if the fuzzer would have generated that specific use case.
  - saagarjha 4y ago
    Sanitizers do help, but they can't catch all bugs. They need to execute a buggy code path to catch issues, and even then they're not perfect.
adgjlsfhk1 4y ago
sanitizers don't work because they only check the paths that you actually run them on. vulnerabilities come from the weird combination of edge cases you didn't test.
- mk89 4y ago
  Thanks. I thought so too, I just wanted to have some confirmation. It's not that they don't find issues, but it's more of a coverage issue then? (In which case I really understand, someone said it's 25 million lines of code...)
  - adgjlsfhk1 4y ago
    it's not even line coverage. to be secure you need to be secure for every combination of branches. at 25 million lines of code, hitting every if/else combination would take longer than the lifetime of the universe.

Do you know why/if a sanitizer is not enough to catch these bugs at runtime (and during their automated tests)?

by mk89 4y ago

Do you know why/if a sanitizer is not enough to catch these bugs at runtime (and during their automated tests)?

saagarjha 4y ago

Google invests heavily in sanitizers. It funded the development of the ones that ship with LLVM.

mk89 4y ago
Yes, I know. My question was more if or why a sanitizer doesn't help.
- pjmlp 4y ago
  Not always, see https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html https://googleprojectzero.blogspot.com/2021/12/this-shouldnt...
  - mk89 4y ago
    My understanding though is that the ASAN would have done its job, had the test checked for the results. Quoting from the post: > This fuzzer might have produced a SECKEYPublicKey that could have reached the vulnerable code, but as the result was never used to verify a signature, the bug could never be discovered. If the result had been used, the ASAN would have kicked in, I guess, or?
    - pjmlp 4y ago
      Well, it is a lot of conditionals, and in any case binaries are seldom shipped with ASAN into production, so it would still be a lottery outcome if the fuzzer would have generated that specific use case.
- saagarjha 4y ago
  Sanitizers do help, but they can't catch all bugs. They need to execute a buggy code path to catch issues, and even then they're not perfect.

adgjlsfhk1 4y ago

sanitizers don't work because they only check the paths that you actually run them on. vulnerabilities come from the weird combination of edge cases you didn't test.

mk89 4y ago
Thanks. I thought so too, I just wanted to have some confirmation. It's not that they don't find issues, but it's more of a coverage issue then? (In which case I really understand, someone said it's 25 million lines of code...)
- adgjlsfhk1 4y ago
  it's not even line coverage. to be secure you need to be secure for every combination of branches. at 25 million lines of code, hitting every if/else combination would take longer than the lifetime of the universe.