C/C++ Source Code Auditing, for developers, and vulnerability hunters

Xeno Kovah

January, 2024

Abstract

This is a dual-audience class. It is for both developers who want to learn how to write code without introducing new vulnerabilities (or how to detect existing vulnerabilities in their own code). But it’s also a class for aspiring code auditors and freelance vulnerability hunters. So it’s an epic battle between contentious developers and devious vulnerability hunters! Who will win?! Whoever most takes the lessons of this class to heart!

This class covers the following 10 vulnerabilities. Linear stack buffer overflows, linear heap buffer overflows, non-linear out-of-bound writes, integer overflows/underflows, “other integer issues” (signed sanity checks, integer truncation, and sign extension), uninitialized data access, race conditions (double fetch and Time of Check, Time of Use (TOCTOU)), use-after-free (UAF), type confusion, and information disclosure.

For each topic area we explain at least 6 real vulnerabilities. And for at least one of those vulnerabilities we explain how it could be exploited, so that students can understand that exploitation engineering is just a typical engineering discipline, akin to a specialized form of software engineering. And thus even when vulnerabilities perhaps don’t look exploitable, they still often are. At the end of each topic area, we cover prevention, detection, and mitigation options for dealing with that vulnerability type.

The full class takes about 5 days. However, this class structure was originally created by Xeno as the basis for an Apple-internal training for its developers, while Xeno worked there. In that quick-form, less vulnerabilities were used, and it was done in a single day. Xeno has also been contracted to customize the vulnerabilities covered in this class for companies that wanted to provide more targeted Secure Development curriculum for their developers.

If you’re interested in teaching your C/C++ developers, or junior vulnerability hunters, reach out to us with info about how many students you’d like us to teach, and where.

Real vulnerabilities covered in class: