Microsoft is giving engineers and developers a way to combat memory corruption issues with the release of VulnScan. VulnScan was created by the Microsoft Security Response Center after receiving a number reports about potential product vulnerabilities.
“In practice, a significant proportion of these reports turn out to be memory corruption issues. In order to root cause these issues, an MSRC security engineer typically needs to analyze the crash and try to understand what went wrong. This workflow isn’t unique to externally reported vulnerabilities; vulnerabilities that are discovered internally through fuzzing and variant investigation are also typically memory corruption issues and these need to be triaged and assessed for exploitability too,” the company wrote in a blog post.
VulnScan is designed to automate the root cause analysis process and determine vulnerability types and cause of memory corruption bugs. The solution is built on Debugging Tools for Windows and Time Travel Debugging. “By leveraging WinDbg and TTD, VulnScan is able to automatically deduce the root cause of the most common types of memory corruption issues,” the company wrote.
VulnScan supports out of bounds read/write, use after free, type confusion, uninitialized memory use and null/constant pointer dereference memory corruption issues.
“Over a 10-month period where VulnScan was used to triage all memory corruption issues for Microsoft Edge, Microsoft Internet Explorer and Microsoft Office products. It had a success rate around 85%, saving an estimated 500 hours of engineering time for MSRC engineers,” Microsoft wrote.
