Nonstandard Sinks Matter: A Comprehensive and Efficient Taint Analysis Framework for Vulnerability Detection in Embedded Firmware
The discovery of vulnerabilities in embedded firmware has received significant attention from security researchers. However, current vulnerability detection methods still suffer from false negatives and inefficiency, which limit detection effectiveness and require substantial analysis time. To allev...
Saved in:
| Published in: | IEEE transactions on dependable and secure computing pp. 1 - 17 |
|---|---|
| Main Authors: | , , , , , , , , |
| Format: | Journal Article |
| Language: | English |
| Published: |
IEEE
2025
|
| Subjects: | |
| ISSN: | 1545-5971, 1941-0018 |
| Online Access: | Get full text |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Abstract | The discovery of vulnerabilities in embedded firmware has received significant attention from security researchers. However, current vulnerability detection methods still suffer from false negatives and inefficiency, which limit detection effectiveness and require substantial analysis time. To alleviate the above problems, we propose a bidirectional path and data flow analysis method, named BPDA, that effectively compensates for the limitations in detecting firmware vulnerabilities at nonstandard sink points. Our key insight is that, some vulnerabilities arise in nonstandard library sinks, and not all user inputs can reach each corresponding sink. Guided by these insights, we design a more comprehensive sink identification algorithm and leverage accurate backward data flow tracking to eliminate the non-vulnerable paths. After that, we execute forward taint analysis and generate the final Proof of Concepts (PoCs). To evaluate the effectiveness of BPDA, we evaluated it on 84 firmware samples (including both Linux and VxWorks firmware) from 8 major brands, comparing it with state-of-the-art methods (i.e., SaTC and Mango). BPDA discovered 163 real vulnerabilities, including 34 0-day vulnerabilities, of which 32 have been confirmed by CVE/CNVD. Besides, results show that BPDA completed its analysis in just 6% of the time required by SaTC, and remarkably identified 21 vulnerabilities that SaTC and Mango had not detected. It also resolved the issue of Mango failing to analyze specific firmware. In addition, we also performed an ablation study to verify the effectiveness of optimization methods in taint analysis. These results demonstrate the superiority of BPDA in terms of effectiveness and efficiency in detecting embedded firmware vulnerabilities. |
|---|---|
| AbstractList | The discovery of vulnerabilities in embedded firmware has received significant attention from security researchers. However, current vulnerability detection methods still suffer from false negatives and inefficiency, which limit detection effectiveness and require substantial analysis time. To alleviate the above problems, we propose a bidirectional path and data flow analysis method, named BPDA, that effectively compensates for the limitations in detecting firmware vulnerabilities at nonstandard sink points. Our key insight is that, some vulnerabilities arise in nonstandard library sinks, and not all user inputs can reach each corresponding sink. Guided by these insights, we design a more comprehensive sink identification algorithm and leverage accurate backward data flow tracking to eliminate the non-vulnerable paths. After that, we execute forward taint analysis and generate the final Proof of Concepts (PoCs). To evaluate the effectiveness of BPDA, we evaluated it on 84 firmware samples (including both Linux and VxWorks firmware) from 8 major brands, comparing it with state-of-the-art methods (i.e., SaTC and Mango). BPDA discovered 163 real vulnerabilities, including 34 0-day vulnerabilities, of which 32 have been confirmed by CVE/CNVD. Besides, results show that BPDA completed its analysis in just 6% of the time required by SaTC, and remarkably identified 21 vulnerabilities that SaTC and Mango had not detected. It also resolved the issue of Mango failing to analyze specific firmware. In addition, we also performed an ablation study to verify the effectiveness of optimization methods in taint analysis. These results demonstrate the superiority of BPDA in terms of effectiveness and efficiency in detecting embedded firmware vulnerabilities. |
| Author | Zhai, Jinyuan Cai, Ruijie Yin, Xiaokang Liu, Long Liu, Shengli Yang, Qichao Song, Enzhou Zhao, Yuhao Zhang, Can |
| Author_xml | – sequence: 1 givenname: Enzhou surname: Song fullname: Song, Enzhou email: songez_ieu@163.com organization: Information Engineering University, Zhengzhou, Henan, China – sequence: 2 givenname: Yuhao surname: Zhao fullname: Zhao, Yuhao email: little_fish02@163.com organization: Information Engineering University, Zhengzhou, Henan, China – sequence: 3 givenname: Can surname: Zhang fullname: Zhang, Can email: 827249870@qq.com organization: Information Engineering University, Zhengzhou, Henan, China – sequence: 4 givenname: Jinyuan surname: Zhai fullname: Zhai, Jinyuan email: booksy2004@163.com organization: Information Engineering University, Zhengzhou, Henan, China – sequence: 5 givenname: Ruijie surname: Cai fullname: Cai, Ruijie email: wsxcrj@163.com organization: Information Engineering University, Zhengzhou, Henan, China – sequence: 6 givenname: Long surname: Liu fullname: Liu, Long email: 164192607@qq.com organization: Information Engineering University, Zhengzhou, Henan, China – sequence: 7 givenname: Qichao surname: Yang fullname: Yang, Qichao email: yangqichaoo@foxmail.com organization: Information Engineering University, Zhengzhou, Henan, China – sequence: 8 givenname: Xiaokang surname: Yin fullname: Yin, Xiaokang email: yxksjtu@sjtu.edu.cn organization: Information Engineering University, Zhengzhou, Henan, China – sequence: 9 givenname: Shengli surname: Liu fullname: Liu, Shengli email: mr_shengliliu@163.com organization: Information Engineering University, Zhengzhou, Henan, China |
| BookMark | eNpFkMtOwzAURC1UJNrCByCx8A-k2InzMLuqD0AqsGhhG93Y18I0cSo7UHXJn5OqldjMzGJmFmdEBq51SMgtZxPOmbzfzNezSczidJJkXMaMXZAhl4JHjPFi0OdUpFEqc35FRiF8MRaLQooh-X1tXejAafCarq3bBvoCXYf-gU7prG12Hj_RBfuDtC_RhTFWWXQd3YDtdeqgPgQb6NJDg_vWb6lpPf34rh16qGxtuwOdY4eqs62j1tFFU6HWqOnS-mYPHq_JpYE64M3Zx-R9udjMnqLV2-PzbLqKFE_SLjICGMSF4VWeGskzEImOdW64yUxVSBCCgYqrHFgumcpAyarQppLaJEKJRCZjwk-_yrcheDTlztsG_KHkrDwyLI8MyyPD8syw39ydNhYR__ucyyzP8uQPbINydw |
| CODEN | ITDSCM |
| ContentType | Journal Article |
| DBID | 97E RIA RIE AAYXX CITATION |
| DOI | 10.1109/TDSC.2025.3619200 |
| DatabaseName | IEEE All-Society Periodicals Package (ASPP) 2005-present IEEE All-Society Periodicals Package (ASPP) 1998-Present IEEE Electronic Library (IEL) CrossRef |
| DatabaseTitle | CrossRef |
| DatabaseTitleList | |
| Database_xml | – sequence: 1 dbid: RIE name: IEEE Electronic Library (IEL) url: https://ieeexplore.ieee.org/ sourceTypes: Publisher |
| DeliveryMethod | fulltext_linktorsrc |
| Discipline | Computer Science |
| EISSN | 1941-0018 |
| EndPage | 17 |
| ExternalDocumentID | 10_1109_TDSC_2025_3619200 11196767 |
| Genre | orig-research |
| GroupedDBID | .DC 0R~ 29I 4.4 5GY 6IK 8R4 8R5 97E AAJGR AASAJ AAWTH ABAZT ABQJQ ABVLG ACGFO ACIWK AENEX AGQYO AHBIQ AKJIK AKQYR ALMA_UNASSIGNED_HOLDINGS ATWAV BEFXN BFFAM BGNUA BKEBE BPEOZ CS3 DU5 EBS EJD HZ~ IEDLZ IFIPE IPLJI JAVBF LAI O9- OCL P2P Q2X RIA RIE RNS .4S 5VS 7WY 8FE 8FG 8FL AAYXX ABJCF ABUWG AETIX AFFHD AFKRA AGSQL AIBXA ARAPS ARCSS AZQEC BENPR BEZIV BGLVJ BPHCQ CCPQU CITATION DWQXO EDO FRNLG GNUQQ HCIFZ ITG ITH K60 K6V K6~ K7- L6V M0C M43 M7S P62 PHGZM PHGZT PQBIZ PQBZA PQGLB PQQKQ PROAC PTHSS RNI RZB |
| ID | FETCH-LOGICAL-c135t-f4a0a28f1b75f916a43d2d7f1f6fb89a440ac2b7a0790c6ac9b8dfb9df34c4393 |
| IEDL.DBID | RIE |
| ISSN | 1545-5971 |
| IngestDate | Sat Nov 29 07:10:03 EST 2025 Wed Oct 15 14:20:43 EDT 2025 |
| IsPeerReviewed | false |
| IsScholarly | true |
| Language | English |
| License | https://ieeexplore.ieee.org/Xplorehelp/downloads/license-information/IEEE.html https://doi.org/10.15223/policy-029 https://doi.org/10.15223/policy-037 |
| LinkModel | DirectLink |
| MergedId | FETCHMERGED-LOGICAL-c135t-f4a0a28f1b75f916a43d2d7f1f6fb89a440ac2b7a0790c6ac9b8dfb9df34c4393 |
| PageCount | 17 |
| ParticipantIDs | crossref_primary_10_1109_TDSC_2025_3619200 ieee_primary_11196767 |
| PublicationCentury | 2000 |
| PublicationDate | 2025-00-00 |
| PublicationDateYYYYMMDD | 2025-01-01 |
| PublicationDate_xml | – year: 2025 text: 2025-00-00 |
| PublicationDecade | 2020 |
| PublicationTitle | IEEE transactions on dependable and secure computing |
| PublicationTitleAbbrev | TDSC |
| PublicationYear | 2025 |
| Publisher | IEEE |
| Publisher_xml | – name: IEEE |
| SSID | ssj0024894 |
| Score | 2.3818781 |
| Snippet | The discovery of vulnerabilities in embedded firmware has received significant attention from security researchers. However, current vulnerability detection... |
| SourceID | crossref ieee |
| SourceType | Index Database Publisher |
| StartPage | 1 |
| SubjectTerms | Buffer overflows Codes Emulation Filtering Manuals Microprogramming Optimization methods Security Testing |
| Title | Nonstandard Sinks Matter: A Comprehensive and Efficient Taint Analysis Framework for Vulnerability Detection in Embedded Firmware |
| URI | https://ieeexplore.ieee.org/document/11196767 |
| hasFullText | 1 |
| inHoldings | 1 |
| isFullTextHit | |
| isPrint | |
| journalDatabaseRights | – providerCode: PRVIEE databaseName: IEEE Electronic Library (IEL) customDbUrl: eissn: 1941-0018 dateEnd: 99991231 omitProxy: false ssIdentifier: ssj0024894 issn: 1545-5971 databaseCode: RIE dateStart: 20040101 isFulltext: true titleUrlDefault: https://ieeexplore.ieee.org/ providerName: IEEE |
| link | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV07T8MwELagYmChPEV56QYmpLR5OHHMVvUhBqiQWhBbZDtnUYmmKLQgRv45tpOqXRhYoii6PHRnx9-d774j5FpqmUjGlBcjRY9qM4y5yKVH0aAJikkqHRPT8z0bjdKXF_5YF6u7WhhEdMln2Lanbi8_n6ulDZV1zLzklmBsm2wzxqpirTWxXuq6HlpI4BmUHNRbmIHPO5P-uGdcwTBuR9ZfsNVsG4vQRlcVt6gMm__8nH2yV6NH6FbmPiBbWByS5qozA9QT9Yj8jCrYZ4MEMLZ7tPDgiDRvoQtWvMTXKnMdjBAMHI-EeRlMxNQcV0wlMFylboHBtvC8fLMc1S6d9hv6uHBpXAVMCxjMJJpfWA7DaTn7EiUek6fhYNK78-pmC54KonjhaSp8EaY6kCzWBjMKGuVhznSgEy1TLij1hQolEz7jvkqE4jLNteS5jqgyqCY6IY1iXuApAUuIg4nPlDTGkDLiGEohrPMSs8g8sEVuVtrP3itOjcz5Ij7PrKkya6qsNlWLHFvNrwVrpZ_9cf2c7NrbqyjJBWksyiVekh31uZh-lFduyPwCUG3B5Q |
| linkProvider | IEEE |
| linkToHtml | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV1LT8MwDI5gIMGFN2I8feCEVOgjbRpuE9s0xJiQGIhblaSOmMQ6VDYQR_45SdoJLhy4VFVlpZWdNJ9j-zMhp1LLRDKmvBgpelSbacxFLj2KBk1QTFLpmJge-2wwSJ-e-F1drO5qYRDRJZ_hub11sfx8omb2qOzCrEtuCcYWyVJMaRhU5Vo_1Hqp63toQYFncHJQBzEDn18M2_dXxhkM4_PIegy2nu3XNvSrr4rbVrrr__ygDbJW40doVQbfJAtYbJH1eW8GqJfqNvkaVMDPHhPAvY3Swq2j0ryEFljxEp-r3HUwQtBxTBLmZTAUI3Odc5VAd568BQbdwuPsxbJUu4TaT2jj1CVyFTAqoDOWaH5iOXRH5fhDlLhDHrqd4VXPq9steCqI4qmnqfBFmOpAslgb1CholIc504FOtEy5oNQXKpRM-Iz7KhGKyzTXkuc6osrgmmiXNIpJgXsELCUOJj5T0hhDyohjKIWw7kvMIjNgk5zNtZ-9VqwamfNGfJ5ZU2XWVFltqibZsZr_EayVvv_H8xOy0hve9rP-9eDmgKzaoaozk0PSmJYzPCLL6n06eiuP3fT5Bo_6xSw |
| openUrl | ctx_ver=Z39.88-2004&ctx_enc=info%3Aofi%2Fenc%3AUTF-8&rfr_id=info%3Asid%2Fsummon.serialssolutions.com&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.atitle=Nonstandard+Sinks+Matter%3A+A+Comprehensive+and+Efficient+Taint+Analysis+Framework+for+Vulnerability+Detection+in+Embedded+Firmware&rft.jtitle=IEEE+transactions+on+dependable+and+secure+computing&rft.au=Song%2C+Enzhou&rft.au=Zhao%2C+Yuhao&rft.au=Zhang%2C+Can&rft.au=Zhai%2C+Jinyuan&rft.date=2025&rft.issn=1545-5971&rft.eissn=1941-0018&rft.spage=1&rft.epage=17&rft_id=info:doi/10.1109%2FTDSC.2025.3619200&rft.externalDBID=n%2Fa&rft.externalDocID=10_1109_TDSC_2025_3619200 |
| thumbnail_l | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/lc.gif&issn=1545-5971&client=summon |
| thumbnail_m | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/mc.gif&issn=1545-5971&client=summon |
| thumbnail_s | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/sc.gif&issn=1545-5971&client=summon |