2018 EuroLLVM Developers’ Meeting: S. Cook “Using Clang Static Analyzer to detect ...”
http://llvm.org/devmtg/2018-04/
—
Using Clang Static Analyzer to detect Critical Control Flow - Simon Cook, Embecosm
Slides: http://llvm.org/devmtg/2018-04/slides...
—
As part of the SECURE project (http://gtr.rcuk.ac.uk/projects?ref=13..., we are implementing transformations and analyses in open-source compilers which reduce programmer effort and error when implementing secure applications.
This talk will discuss our work on extending the clang static analyzer to detect when "critical" variables are used to affect control flow. Critical variables are sensitive pieces of information that a programmer wishes to keep secret (such as cryptographic keys), and their use in the control flow graph can cause them to leak through side channel attacks.
Our checker searches for branches that depend on critical variables and values derived from such critical variables and generates reports informing a user where the value became critical in their program. We discuss our experience in extending the checker to detect cases where it is the type itself that is of interest rather than a particular value, as we are interested in whether a variable is critical, irrespective of the value it holds at any given time.
—
Videos Filmed & Edited by Bash Films: http://www.BashFilms.com