The a Vulnerabilities of GCC and LLVM to Optimization Pipeline Attacks

Purpose of the study: the purpose of the work is to develop recommendations for the implementation of secure software development tools and the implementation development processes based on the analysis of information security threats in software development related to the possibility of creating and using extension modules for optimizing compilers by attackers. Methods of research: the main research methods include analysis and synthesis, modeling and experiment. Result(s): the article examines the vulnerabilities of optimizing compilers of GCC and LLVM to malicious interference in the optimization pipeline, which can be carried out by hackers through standard software interfaces provided to enhance the functionality of such compilers and the effectiveness of software developed with their help. The relevance of the work is determined by the current regulatory and technical requirements for developers of secure software to analyze information security threats from software development tools, one of the key elements of which are optimizing compilers. The article discusses the features of the analysis and transformation of the source code by optimizing compilers of GCC and LLVM in the process of optimizing the source code. The possibility of practical implementation of attacks that change the optimization pipeline in such a way that the algorithm of functioning of the target application fundamentally changes in the way required by the attacker is shown. As a result, recommendations are given on how to neutralize such threats. Scientific novelty: the paper shows the need to expand the regulatory requirements for secure C/C++ compilers and measures to develop secure software, in terms of the need to control the use of extension modules for the tools used.