search

GaloisInc / MATE

MATE is a suite of tools for interactive program analysis with a focus on hunting for bugs in C and C++ code using Code Property Graphs.
https://galoisinc.github.io/MATE/
BSD 3-Clause "New" or "Revised" License
177 stars 12 forks source link

UAF POI doesn't count uses of subregions #52

Closed shinmao closed 1 year ago

shinmao commented 2 years ago

Hi there, I am crazy about MATE. When I tried to put a sample C code with UAF vulnerabilities (Link attached), MATE showed nothing and just an empty page in POI. Can you help me to figure it out? Thanks.

thinkmoore commented 2 years ago

It sounds like the POI analyses didn't run. There's a couple ways you can trigger them:

  1. When you use mate-cli oneshot, provide the -p option to run all POIs (https://galoisinc.github.io/MATE/cli.html#cmdoption-mate-cli-oneshot-p)
  2. If you've already built the POI, you can use the mate-cli analysis command to run the POIs (or one in particular) (https://galoisinc.github.io/MATE/cli.html#mate-cli-analysis-run)
  3. You can use the run_all_analyses endpoint of the Rest API in the Experts tab (https://galoisinc.github.io/MATE/api.html#operation/_run_all_analyses_api_v1_analyses_run__build_id__post

Thanks for giving MATE a try!

langston-barrett commented 2 years ago

MATE showed nothing

@shinmao shared some additional context with me via email, I believe that this means that @shinmao didn't see a graph pre-populated in Flowfinder. This is the expected behavior. Rafael, you might try entering a function name in the "Select a function node to start" box. Then you'll be able to right-click the node that appears and explore the graph.

The Flowfinder tutorial describes this step. There is also a video of someone exploring a program with Flowfinder.

langston-barrett commented 2 years ago

It sounds like the POI analyses didn't run.

It looks like the POIs don't report any findings for this program. I ran them all, they all completed with 0 findings. This may be a bug in our UAF POI query, or Clang may have complied away the undefined behavior---the UAF in this program is fairly trivial (it's an intra-procedural UAF not guarded by a conditional).

thinkmoore commented 2 years ago

After a little more debugging, this is a limitation in the UAF query. Currently, the query it uses to find "uses" doesn't include loads of all sub-regions of the allocation being freed. This isn't a fundamental limitation, and we'll work on a patch. In the meantime, you can experiment with the POI by changing the line msgbox->bye(); to msgbox->welcome();. This will make the load match the current query and return a POI.

Thanks for the question / bug report!

shinmao commented 2 years ago

Sure, thanks. I will try some more examples on it. Keep in touch!

shinmao commented 2 years ago

msgbox->bye();

@thinkmoore Do you mean to change line 71? I tried it but still return nothing. Thanks.