PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Catching OpenSSL misuse using CodeQL

blog.trailofbits.com | blog | #appsec | #cryptography | #c | #openssl | #static-analysis | #codeql | #cpp
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Five CodeQL queries catch OpenSSL libcrypto misuse—short cipher keys, missing entropy initialization, and uncleared bignums—that can cause memory leaks or authentication bypasses in C/C++ codebases.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Taming 2,500 compiler warnings with CodeQL, an OpenVPN2 case study
A CodeQL query cut 2,500+ implicit-conversion warnings in OpenVPN2 to just 20 high-priority cases, showing how range analysis and dataflow modeling surface dangerous type conversions in C.
blog · blog.trailofbits.com
Publishing Trail of Bits’ CodeQL queries
Trail of Bits published custom CodeQL queries for Go and C that uncover issues standard queries miss: (EC)DSA misuse, insecure file permissions, string bugs, and missing TLS minimum versions.
blog · blog.trailofbits.com
Typos that omit security features and how to test for them
An audit found a typo that silently disabled _FORTIFY_SOURCE; the team found and fixed twenty similar C/C++ bugs on GitHub and shows how to test builds for this missed mitigation.
blog · blog.trailofbits.com
High-fidelity build instrumentation with blight
Trail of Bits open-sourced blight, a Python framework that wraps and instruments C/C++ build tools, enabling caching, static analysis, profiling, and build assurance without fragile compiler hacks.
blog · blog.trailofbits.com
Detecting Iterator Invalidation with CodeQL
Itergator, a set of CodeQL classes and queries built during a Trail of Bits internship, detects C++ iterator invalidation—undefined behavior that often yields exploitable bugs—in real-world code.
blog · blog.trailofbits.com
Using Static Analysis and Clang To Find Heartbleed
Trail of Bits built a Clang analyzer plugin that statically detects Heartbleed-style bugs: it taints ntohl/ntohs return values and flags unconstrained data used as memcpy sizes, tested on OpenSSL.
Back