Abstract
This paper presents the results of a case study on software vulnerability solutions in the Linux kernel. Our major contribution is the introduction of a classification of methods used to solve vulnerabilities. Our research shows that error handling, redesign, and precondition validation are the most used methods in solving vulnerabilities in the Linux kernel. This contribution is accompanied with statistics on the occurrence of the different types of vulnerabilities and their solutions that we observed during our case study, combined with example source code patches. We also combine our findings with existing programming guidelines to create the first security-oriented coding guidelines for the Linux kernel.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
AusCERT. Secure unix programming checklist, 1996. http://www. auscert.org.au/render.html?it=1975.
BitKeeper. Bitkeeper, 2005. http://linux.bkbits.net/.
Bugtraq. Bugtraq, 2005. http://groups.google.ca/group/mailing.unix. bugtraq and http://www.securityfocus.com/archive/1.
CERT. Cert advisories, 2005. http://www.us-cert.gov/cas/techalerts/ index.html.
Shuo Chen, Zbigniew Kalbarczyk, Jun Xu, Ravishankar, and K. Iyer. A data-driven finite state machine model for analyzing security vulnerabilities. In 2003 International Conference on Dependable Systems and Networks (DSN’03), page 605. IEEE, 2003.
Various Contributors. Linux Kernel Mailing List Archives via Google. 2005. http://groups.google.com/groups?q=linux+kernel.
Debian. The debian’s svn repository, 2005. http://svn.debian.org/wsvn/ kernel/.
Dawson Engler, Benjamin Chelf, Andy Chou, and Seth Hallem. Checking system rules using system-specific, programmer-written compiler extensions. In Proceedings of OSDI 2000. Usenix, 2000.
David Evans and David Larochelle. Improving security using extensible lightweight static analysis. IEEE Software, Jan/Feb 2002.
Steve Hamm. Linux inc. BusinessWeek Online, 01 2001. http://www. businessweek.com/magazine/content/05 05/b3918001 mz001.htm.
Brian Hatch, James Lee, and George Kurtz. Hacking Exposed Linux, 2nd Edition. McGraw-Hill Osborne Media, 2002.
Simon Horman. Ultra monkey: Kernel security bug database, 2005. http://www.ultramonkey.org/bugs/cve/.
M. Howard and D. LeBlanc. Writing Secure Code, 2nd edition. Microsoft Press, 2002.
**e Huagang. Lids: Linux intrusion detection system. http://www.lids. org/.
Jack Koziol, David Litchfield, Dave Aitel, Chris Anley, Sinan“noir”Eren, Neel Mehta, and Riley Hassell. The Shellcoder’s Handbook : Discovering and Exploiting Security Holes. John Wiley & Sons, 2004.
Macadamian. Macadamian’s code review checklist. http://www.macadamian.com/index.php?option=com content&task= view&id=27&Itemid=31.
D. Mackenzie, P. Eggert, and R. Stallman. Comparing and Merging Files. Free Software Foundation, 2002. http://www.gnu.org/software/ diffutils/manual/ps/diff.ps.gz.
Scott Mann, Ellen Mitchell, and Mitchell Krell. Linux System Security. Pearson Education, 2002.
Sun Microsystems. Security code guidelines, 2000. http://java.sun.com/ security/seccodeguide.html.
NIST. National vulnerability database, 2005. http://nvd.nist.gov/.
NIST. National vulnerability database statistics, 2005. http://nvd.nist. gov/statistics.cfm.
OpenWall. Openwall gnu/*/linux (owl) -a security-enhanced server platform. http://www.openwall.com/Owl/.
Marc-André Laverdière-Papineau. Towards Systematic Software Security Hardening. Master’s thesis, Concordia Institute for Information Systems Engineering, Concordia University, August 2007.
B. Schwarz, Hao Chen, D. Wagner, J. Lin, Wei Tu, G. Morrison, and J. West. Model checking an entire linux distribution for security violations. In Proceedings of the 21st Annual Computer Security Applications Conference, pages 13–22. IEEE, 2005.
R. Seacord. Secure Coding in C and C++. SEI Series. Addison-Wesley, 2005.
Adam Shostack. Security code review guidelines, 2004. http://www. homeport.org/ adam/review.html.
Stephen Smalley, Chris Vance, and Wayne Salamon. Implementing selinux as a linux security module. http://www.nsa.gov/selinux/papers/ module.pdf.
Visual Studio Team System. Guidelines for writing secure code. http://msdn2.microsoft.com/en-us/library/ms182020.aspx.
Linus Torvalds. Linux kernel coding style. http://www.llnl.gov/linux/ slurm/coding style.pdf.
Dimitri van Heesch. doxygen Manual for version 1.4.6. Doxygen, 2004. ftp://ftp.stack.nl/pub/users/dimitri/doxygen manual-1.4.6.pdf.zip.
Steven J. Vaughan-Nichols. Linux server market share keeps growing. Linux-Watch Online, May 2007. http://www.linux-watch.com/news/ NS5369154346.html.
D. Wheeler. Unix and linux secure coding howto, 2003.
R. Wita and Y. Teng-Amnuay. Vulnerability profile for linux. In Proceedings of the 19th International Conference on Advanced Information Networking and Applications, pages 953–958. IEEE, 2005.
C. Wright, C. Cowan, J. Morris, S. Smalley, and G. Kroah-hartman. Linux security modules: General security support for the linux kernel, 2002.
Chris Wright. OOPS Linux Kernel Security Patches in the GIT Repository. 2005.http://www.kernel.org/git/?p=linux/kernel/git/chrisw/ stable-queue.git;a=tree.
Various Contributors and GNU Project. GNU Compiler Collection (GCC). Free Software Foundation, Inc., 1998-2005. http://gcc.gnu.org/onlinedocs/gcc/
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2008 Springer Science+Business Media B.V.
About this paper
Cite this paper
Mokhov, S.A., Laverdière, MA., Benredjem, D. (2008). Taxonomy of Linux Kernel Vulnerability Solutions. In: Iskander, M. (eds) Innovative Techniques in Instruction Technology, E-learning, E-assessment, and Education. Springer, Dordrecht. https://doi.org/10.1007/978-1-4020-8739-4_86
Download citation
DOI: https://doi.org/10.1007/978-1-4020-8739-4_86
Publisher Name: Springer, Dordrecht
Print ISBN: 978-1-4020-8738-7
Online ISBN: 978-1-4020-8739-4
eBook Packages: Computer ScienceComputer Science (R0)