Characterizing Buffer Overflow Vulnerabilities in Large C/C++ Projects

Security vulnerabilities are present in most software systems, especially in projects with a codebase, with several versions over the years, developed by many developers. Issues with memory , in particular buffer over ow, are among the most frequently exploited vulnerabilities in systems developed in C/CCC. Nevertheless, most buffer over ow vulnerabilities are not detectable vulnerability detection tools and static analysis tools (SATs). To improve vulnerability detection, we need better understand the characteristics of such vulnerabilities and their root causes. In this study, we analyze 159 vulnerable code units from three representative projects (i.e., Linux Kernel, Mozilla, and Xen). First, vulnerable code is characterized using the Orthogonal Defect Classi cation (ODC), showing that most over ow vulnerabilities are related to missing or incorrect checking (e.g., missing if construct around or incorrect logical expression used as branch condition). Then, we run two widely used C/CCC Analysis Tools (SATs) (i.e., CppCheck and Flaw nder) on the vulnerable and neutral (after the x) versions of each code unit, showing the low effectiveness of this type of tool in detecting over ow vulnerabilities. Finally, we characterize the vulnerable and neutral versions of each code using software metrics, demonstrating that, although such metrics are frequently used as indicators of quality, there is no clear correlation between them and the existence of buffer over ow in the code. a result, we highlight a set of observations that should be considered to improve the detection of buffer ow vulnerabilities.