This paper explores computer security vulnerabilities that are generated inadvertently by a compiler. By using a novel approach of examining the assembly language and other intermediate files generated by the compilation process, it has been successfully demonstrated that the compiler’s processing of the high-level source code can create a vulnerable end product. Proper software assurance is intended to provide confidence that software is free from vulnerabilities, and compiler-induced vulnerabilities reduce this confidence level. The discovered vulnerabilities can be related to standard vulnerability classes, side channel attacks, undefined behavior, and persistent state violations. Additionally, the research revealed that the executable machine code generated by the compiler can differ in structure from the original source code due to simplifications and optimizations performed during the compilation process that cannot be disabled. This research examined both the open-source GNU C compiler and the Microsoft C/C++ compiler that is part of the Microsoft Visual Studio package. Both of these compilers are widely used and represent typical compilers in use today.


    Access

    Check access

    Check availability in my library

    Order at Subito €


    Export, share and cite



    Title :

    Evaluation of Compiler-Induced Vulnerabilities



    Published in:

    Publication date :

    2019-08-22


    Size :

    18 pages




    Type of media :

    Article (Journal)


    Type of material :

    Electronic Resource


    Language :

    English




    Satellite Vulnerabilities

    J. W. Rooker | NTIS | 2008


    Ada compiler evaluation capability (ACEC) - An overview

    LEAVITT, TOM / TERRELL, KERMIT / DECKER-LINDSEY, BARBARA | AIAA | 1989


    Identification of Cyber Vulnerabilities

    Olsen, Alexander | Springer Verlag | 2024


    DETECTING AND PATCHING NETWORK VULNERABILITIES

    CASELLA ALEX / SINGH MANU / COVELL GRANT | European Patent Office | 2020

    Free access

    Fault-Tree Compiler

    Butler, Ricky W. / Boerschlein, David P. | NTRS | 1993