TY - GEN
T1 - Understanding security vulnerabilities in file systems
AU - Cai, Miao
AU - Huang, Hao
AU - Huang, Jian
N1 - Publisher Copyright:
© 2019 Copyright held by the owner/author(s). Publication rights licensedto ACM.
PY - 2019/8/19
Y1 - 2019/8/19
N2 - File systems have been developed for decades with the securitycritical foundation provided by operating systems. However, they are still vulnerable to malware attacks and software defects. In this paper, we undertake the first attempt to systematically understand the security vulnerabilities in various file systems. We conduct an empirical study of 157 real cases reported in Common Vulnerabilities and Exposures (CVE). We characterize the file system vulnerabilities in different dimensions that include the common vulnerabilities leveraged by adversaries to initiate their attacks, their exploitation procedures, root causes, consequences, and mitigation approaches. We believe the insights derived from this study have broad implications related to the further enhancement of the security aspect of file systems, and the associated vulnerability detection tools.
AB - File systems have been developed for decades with the securitycritical foundation provided by operating systems. However, they are still vulnerable to malware attacks and software defects. In this paper, we undertake the first attempt to systematically understand the security vulnerabilities in various file systems. We conduct an empirical study of 157 real cases reported in Common Vulnerabilities and Exposures (CVE). We characterize the file system vulnerabilities in different dimensions that include the common vulnerabilities leveraged by adversaries to initiate their attacks, their exploitation procedures, root causes, consequences, and mitigation approaches. We believe the insights derived from this study have broad implications related to the further enhancement of the security aspect of file systems, and the associated vulnerability detection tools.
UR - http://www.scopus.com/inward/record.url?scp=85076464139&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85076464139&partnerID=8YFLogxK
U2 - 10.1145/3343737.3343753
DO - 10.1145/3343737.3343753
M3 - Conference contribution
AN - SCOPUS:85076464139
T3 - Proceedings of the 10th ACM SIGOPS Asia-Pacific Workshop on Systems, APSys 2019
SP - 8
EP - 15
BT - Proceedings of the 10th ACM SIGOPS Asia-Pacific Workshop on Systems, APSys 2019
PB - Association for Computing Machinery
T2 - 10th ACM SIGOPS Asia-Pacific Workshop on Systems, APSys 2019
Y2 - 19 August 2019 through 20 August 2019
ER -