MIT researchers have produced a new paper that uncovers security flaws in C and C++ software, generated by compiler optimizations that discard ambiguous code or code, which produce undefined behavior.
Some of that code includes security-relevant checks and the paper includes examples of null pointer checks and pointer overflow checks that the GCC compiler optimizes away, leaving the resulting object code exploitable.
More complex ambiguous code includes things like bit shift operations that operate one way on x86 and operate another way on different architectures such as ARM.
The MIT team produced a new static source code checker named STACK that identifies such code, which they term “undefined behavior” and “unstable code.”
The researchers identified 32 bugs inside the Linux kernel, five in the Python programming language and nine in the Posgres DBMS. More worryingly, the team ran Stack against the Debian Linux archive, of which 8575 out of 17432 packages contained C/C++ code. For a whopping 3471 packages, STACK detected at least one instance of unstable code.
The research paper can be found at: http://pdos.csail.mit.edu/~xi/papers/stack-sosp13.pdf