Search papers, labs, and topics across Lattice.
This paper investigates the suitability of LLM-based Automated Program Repair (APR) for securing cross-compartment interfaces in compartmentalized software, which are often vulnerable. They found that existing APR approaches and general-purpose LLMs are insufficient for this task due to a lack of compartmentalization awareness. To address this, they developed a new APR framework that integrates a specialized fuzzer, a compartmentalization-aware patch generation component, and a patch validation component, demonstrating its effectiveness on a sample interface vulnerability.
Securing vulnerable cross-compartment interfaces may be possible with a new APR framework that bridges the compartmentalization awareness gap in existing LLMs.
Software compartmentalization breaks down an application into compartments isolated from each other: an attacker taking over a compartment will be confined to it, limiting the damage they can cause to the rest of the application. Despite the security promises of this approach, recent studies have shown that most existing compartmentalized software is plagued by vulnerabilities at cross-compartment interfaces, allowing an attacker taking over a compartment to escape its confinement and negate the security guarantees expected from compartmentalization. In that context, securing cross-compartment interfaces is notoriously difficult and engineering-intensive. In light of recent advances in Automated Program Repair (APR), notably through the use of Large Language Models (LLMs), this paper presents a work in progress investigating the suitability of LLM-based APR at securing cross-compartment interfaces as automatically as possible. We observe that existing APR approaches and general purpose/code-centric LLMs used as is are unfit for this task, and present the design, implementation, and early results of a new APR framework dedicated to compartment interface safety. The framework integrates into a feedback loop 1) a specialized fuzzer uncovering cross-compartment interface vulnerabilities; 2) a patch generation component bridging the lack of compartmentalization awareness of existing LLMs with a series of analysis techniques; and 3) a patch validation component assessing the effectiveness of generated vulnerability fixes. We validate our framework over a sample interface vulnerability, comparing it to a naive use of general-purpose LLMs, and discuss future research avenues.
