Bridge: High-Order Taint Vulnerabilities Detection in Linux-Based IoT Firmware

The rapid proliferation of IoT devices has led to a surge in security incidents stemming from vulnerabilities in firmware. IoT device security is critical, as failures can result in privacy breaches, system downtime, and life-threatening situations. While taint analysis has been a standard approach for detecting vulnerabilities, the increasing complexity of modern IoT devices has introduced high-order taint vulnerabilities that traditional methods cannot address. These vulnerabilities often require the coordination of multiple requests and components, making detection particularly challenging. This paper presents Bridge, a novel approach to detecting high-order taint vulnerabilities in IoT firmware. Bridge operates in three stages: identifying entry points (i.e., the initial handlers corresponding to different action requests) and taint source functions (i.e., functions for parsing user-controllable data), constructing binary dependency graphs for tainted data propagation, and constructing action dependency graphs to trace taint vulnerability triggering control relationships. Extensive evaluation on 44 real-world firmware samples demonstrates that Bridge outperforms state-of-the-art tools, detecting $\mathbf{1, 1 6 8}$ true positive vulnerabilities including 566 high-order vulnerabilities. Moreover, among the results, 90 vulnerabilities (including 45 high-order vulnerabilities) have been confirmed by vendors (CVE/PSV) and pose a threat to device security, including remote code execution and denial of service.