Moritz Sanft and Flavio Toffalini, Ruhr-Universität Bochum
During software testing, analysts use sanitizers like ASan and UBSan to effectively detect memory corruption and undefined behavior. However, existing sanitizers cannot detect semantic bugs. These vulnerabilities arise from incorrect program environment interactions that lead to formally valid but unintended system states. Semantic bugs, which include path traversals, command injections, and arbitrary file writes, require tedious manual analysis to identify.
We present SEMSAN, a generic framework to identify semantic bugs during testing. SEMSAN enables analysts to define Sanitizer Primitives, which are small programs that monitor kernel events and validate security invariants at runtime. SEMSAN provides high-level utilities for inspecting filesystem metadata, process credentials, and namespace configurations, enabling the expression of complex invariants without low-level kernel knowledge. Our eBPF-based implementation integrates seamlessly with coverage-guided fuzzers while introducing negligible runtime overhead on production workloads.
We evaluate SEMSAN through both micro- and macro-benchmarks, successful reproduction of ten known CVEs, and real-world deployment. Macro-benchmarks on Apache and PostgreSQL demonstrate less than 1% overhead, while micro-benchmarks show 3--20% overhead in worst-case scenarios with continuous sanitizer triggering. SEMSAN discovered five previously unknown vulnerabilities, including privilege escalations in Git and Docker, a 21-year-old path traversal in ViewVC, and a remote code execution in Grafana. All vulnerabilities were responsibly disclosed and are either patched or in the process of being patched.
