Talk Title : Scanning for Traditional Memory Corruption Vulnerabilities in Python using LLMs

Motivation

Why Python

Language Adoption

Python has fast become the language chosen for quick prototyping and business logic in production code as the software industry rapidly moves towards adapting LLMs into their core services.  Cross Platform High level languages with Runtimes written in C allow for the speed afforded by low level memory manipulation capabilities and an additional layer of security through bounds checking and program correctness with the convenience of abstracting away how the memory is laid out on the bare metal. 

Reach

Most popular and stable operating systems ship with a compatible python3 binary. Chances are that your public facing infrastructure serving production code is deployed using a Dockerfile where the python3 program runs as root ( ! !! )

Example Impact Scenario

If a code injection vulnerability exists in a reachable part of the software stack used for an internet exposed web app where user input is passed to a python3 script, the vulnerable CPython runtime can be exploited for arbitrary code execution. 

+------------------------+
|  Untrusted User Input  |
+------------------------+
            |
            v
+------------------------+
|      Python 3 Code     |
|  (Application Logic)   |
+------------------------+
            |
            v
+------------------------+
|    CPython Runtime     |
|------------------------|
| High-Level Safeguards  |
| • Memory safety at     |
|   the language level   |
| • Bounds checking      |
| • Automatic GC / RefCt |
| • Exceptions           |
+------------------------+
            |
            v
+------------------------+
|   Native C Runtime     |
|------------------------|
| Traditional C Risks    |
| • Buffer overflows     |
| • Use-after-free       |
| • Integer overflows    |
| • Heap corruption      |
| • Memory corruption    |
+------------------------+

Historical Case Studies

Session Details

In this session I will discuss and describe the following:

• The python3 bytecode VM, the execution of python3 scripts and how the program looks in memory ( on the RAM )

• Setting up of a fuzzing framework (an existing FOSS project https://github.com/devdanzin/fusil ) for CPython, for finding possible Buffer Overflow vulnerabilities and leveraging LLMs for C code scanning. 

• Breakdown of a Buffer Overflow Exploit and a Live demo 

• An understanding of Python’s CPython Virtual Machine

• An understanding of how a Python3 program looks in Memory ( on your RAM ) when executed.

• Live Demo of an Example Buffer Overflow POC for exploiting existing vulnerabilities