# ERACE: Toward Facilitating Exploit Generation for Kernel Race Vulnerabilities
## 6 Evaluation
### Accuracy  
In this section, we evaluate the accuracy in identifying the race points, the timing relationships among the race instructions, and the triggering types (see Table 1 for the experimental results). In general, ERACE can effectively identify most race points, the timing relationships among the race instructions, and the triggering types. ERACE identified a total of 19 vulnerabilities' race points. The experiments show that ERACE can effectively help researchers locate vulnerable points, that is, race points. Moreover, to verify whether relaxed alias analysis brings improvements, we compared the number of race points that can be identified with and without relaxed alias analysis. To ensure the accuracy of the results, the other conditions were unchanged, except for the alias analysis component in ERACE. AA-SVF indicates the use of alias analysis in SVF, and Improved AA-ERACE indicates the use of relaxed alias analysis. The experimental results show that without improving alias analysis, only 4 vulnerabilities' race points were identified, whereas 15 more vulnerabilities' race points were identified with relaxed alias analysis. We analyzed the specific program context of each vulnerability's race point. The race points of CVE-2016-6516, CVE-2017-10661, and e010[27] were located in the same function or on the same path, and the race variable of 4d33[24] was on a stack so traditional alias analysis could easily identify these race points. The race points of the 15 vulnerabilities were located on different paths. That is to say, users must use different system call interfaces to trigger the execution of different race instructions. As long as the user passes in certain identical parameters, the race variables accessed by the race instruction satisfy the alias relationships. Traditional alias analysis cannot identify such aliases. Relaxed alias analysis will treat the same objects in different functions as the same memory. Although this will cause false positives, filtering with the collected dynamic execution paths can effectively reduce false positives. We analyzed four cases where ERACE failed to identify the race points. CVE-2015-8550 is quite special. This vulnerability does not exist in the source code. It was introduced after a gcc compilation. The user-space data were accessed twice but the consistency of the data was not checked, resulting in control-flow hijacking. When compiled with Clang, there was \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**CVE**} & \multirow{2}{*}{**Race Variable**} & \multicolumn{3}{c}{**Race Point**} & \multirow{2}{*}{\begin{tabular}{c} **Recognized Triggering Type** \\ **Relationship** \\ \end{tabular} } & \multirow{2}{*}{\
\begin{tabular}{c} **Recognized Triggering Type** \\ **Type** \\ \end{tabular} } & \multirow{2}{*}{**
\begin{tabular}{c} **Recognized Triggering Type** \\ **Typical** \\ \end{tabular} } \\  & & & **AA-SVF** & & **Improved** & **Relationship** & **Triggering** \\ \hline def3... [26] & ✗ & ✗ & ✗ & ✗ & ✗ & PAGEFAULT & ✗ & ✗ \\ \hline e010... [27] & prev-\(>\)refs & ✓ & ✓ & ✓ & Double-Free & ✗ & ✓ \\ \hline
9824... [28] &
\begin{tabular}{c} sk- \\ \textgreater{}sk\_dst\_cache \\ \end{tabular} & ✗ & ✓ & ✓ & Double-Free & ✗ & ✓ \\ \hline Overall & * & 4 & 19 & 17 & * & 10 & 17 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._no such vulnerability so the race point could not be identified. The PoC of CVE-2017-15951 could not trigger kernel vulnerabilities so it was impossible to determine whether the vulnerability path was collected. Public information on CVE-2017-15951 is very vague and it cannot provide researchers with enough information to confirm its triggering type and root cause. CVE-2019-11599 is due to access competition between VMA virtual mapping spaces and not between the general memory variables so ERACE could not detect the race points. def3[26] could only trigger a page fault so we could not find its race points.