Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs

Compilers assure that any produced optimized code is semantically equivalent to the original code. However, even "correct" compilers may introduce security bugs as security properties go beyond translation correctness. Security bugs introduced by such correct compiler behaviors can be disputable; compiler developers expect users to strictly follow language specifications and understand all assumptions, while compiler users may incorrectly assume that their code is secure. Such bugs are hard to find and prevent, especially when it is unclear whether they should be fixed on the compiler or user side. Nevertheless, these bugs are real and can be severe, thus should be studied carefully. We perform a comprehensive study on compiler-introduced security bugs (CISB) and their root causes. We collect a large set of CISB in the wild by manually analyzing 4,827 potential bug reports of the most popular compilers (GCC and Clang), distilling them into a taxonomy of CISB. We further conduct a user study to understand how compiler users view compiler behaviors. Our study shows that compiler-introduced security bugs are common and may have serious security impacts. It is unrealistic to expect compiler users to understand and comply with compiler assumptions. For example, the "no-undefinedbehavior" assumption has become a nightmare for users and a major cause of CISB. Table 4: A three-layer taxonomy of compiler introduced security bugs. Root cause Insecure optimization behaviors Security consequences Eliminating security related code §4.1 Elimination of security checks Implicit Specification §4 Elimination of critical memory operations (No-UB, Default-behavior, Reordering order-sensitive security code §4.2 Disorder between order-sensitive memory operations and Environment) Disorder between security checks and dangerous operations Introducing insecure instructions §4.3