Ada and the Software Vulnerabilities Project
Total Page:16
File Type:pdf, Size:1020Kb
1 Ada and the Software Vulnerabilities Project Alan Burns, FREng (ed.) Department of Computer Science, University of York, York YO1 5DD UK; Tel: +44 (0)1904 432779; email: [email protected] Joyce L. Tokar, PhD(ed.) Pyrrhus Software, PO Box 1352, Phoenix, AZ, 85001-1352, USA.; Tel: +1 602373 0713; email: [email protected] Stephen Baird, John Barnes, Rod Chapman, Gary Dismukes, Michael González-Harbour, Stephen Michell, Brad Moore, Miguel Pinho, Erhard Ploedereder, Jorge Real, J.P. Rosen, Ed Schonberg, S. Tucker Taft, T. Vardanega conducted in parallel with the 2009 SIGAda conference. Abstract Work continued on this document over the course of 2009 Given the large focus on software vulnerabilities and was completed in a short workshop at the 15th in the current market place, ISO/IEC JTC 1/SC International Conference on Reliable Software 22/WG 23 has developed a Technical Report Technologies – Ada-Europe 2010. (TR) on Vulnerabilities [1]. This TR contains This content of this article is the final draft copy of the Ada vulnerabilities that may be applicable to a Annex to the WG 23 TR that will be submitted to WG 23 programming language or application. This for inclusion in the TR. The article also includes the Annex article provides a synopsis of these for SPARK that was developed by Altran-Praxis. vulnerabilities with respect to the Ada programming language [2]. Note, within the WG 23 TR each vulnerability is assigned a unique identifier such as RIP for the Inheritance Keywords: software vulnerabilities, software vulnerability. Since the WG 23 TR was under development vulnerability, Ada, SPARK. during the work on this Annex and there is an expectation that more vulnerabilities will be added to the TR, the 1 Introduction sections in the Ada Annex include their corresponding Software vulnerabilities are defined as a property of a unique identifier in the section heading. system security, requirements, design, implementation, or operation that could be accidentally triggered or References intentionally exploited and result in a security failure [3]. [1] ISO/IEC JTC 1/SC 22 N 4522, ISO/IEC TR 24772, Work on software vulnerabilities and how they enable Information Technology — Programming Languages software applications to be infiltrated and corrupted — Guidance to Avoiding Vulnerabilities in continues to be of interest world. Working Group 23 (WG Programming Languages through Language Selection 23) of the Programming Languages Subcommittee (SC 22) and Use, 7 November 2009. of the International Organization of Standards (ISO) has recently completed a Technical Report that identifies and [2] Taft, S. Tucker, Duff, R. A., Brukardt, R. L., enumerates a collection of software vulnerabilities in Ploedereder, E., Leroy, P, Ada Reference Manual, existing programming languages [1]. Annexes to this LNCS 4348, Springer, Heidelberg, 2006. document are being developed to identify if the [3] NIST Special Publication 268, “Source Code Security vulnerabilities defined in the TR exist in various Analysis Tool Functional Specification Version 1.0,” programming languages. May 2007. A workshop was conducted in parallel with the 14th [4] Ada User Journal, Volume 22, 2009. International Conference on Reliable Software Technologies – Ada-Europe 2009 to initiate the development of content of an Annex to the Technical Report that documents its applicability to the Ada and SPARK programming languages. The results of this workshop were published in [4]. Another workshop was Ada.2 General terminology and Annex Ada – Final Draft concepts Ada.Specific information for Access object: An object of an access type. vulnerabilities Access-to-Subprogram: A pointer to a subprogram (function or procedure). Every vulnerability description of Clause 6 of the main Access type: The type for objects that designate document is addressed in the annex in the same (point to) other objects. order even if there is simply a note that it is not relevant to Ada. Access value: The value of an access type; a value that is either null or designates (points at) another This Annex specifies the characteristics of the Ada object. programming language that are related to the vulnerabilities defined in this Technical Report. When Attributes: Predefined characteristics of types and applicable, the techniques to mitigate the vulnerability objects; attributes may be queried using syntax of the in Ada applications are described in the associated form <entity>'<attribute_name>. section on the vulnerability. Bounded Error: An error that need not be detected either prior to or during run time, but if not detected, Ada.1 Identification of standards and then the range of possible effects shall be bounded. associated documentation Case statement: A case statement provides multiple ISO/IEC 8652:1995 Information Technology – paths of execution dependent upon the value of the Programming Languages—Ada. case expression. Only one of alternative sequences of statements will be selected. ISO/IEC 8652:1995/COR.1:2001, Technical Corrigendum to Information Technology – Case expression: The case expression of a case Programming Languages—Ada. statement is a discrete type. ISO/IEC 8652:1995/AMD.1:2007, Amendment to Case choices: The choices of a case statement must Information Technology – Programming Languages— be of the same type as the type of the expression in Ada. the case statement. All possible values of the case expression must be covered by the case choices. ISO/IEC TR 15942:2000, Guidance for the Use of Ada in High Integrity Systems. Compilation unit: The smallest Ada syntactic construct that may be submitted to the compiler. For ISO/IEC TR 24718:2005, Guide for the use of the Ada typical file-based implementations, the content of a Ravenscar Profile in high integrity systems. single Ada source file is usually a single compilation unit. Lecture Notes on Computer Science 5020, “Ada 2005 Rationale: The Language, the Standard Libraries,” Configuration pragma: A directive to the compiler that John Barnes, Springer, 2008. is used to select partition-wide or system-wide options. The pragma applies to all compilation units Ada 95 Quality and Style Guide, SPC-91061-CMC, appearing in the compilation, unless there are none, version 02.01.01. Herndon, Virginia: Software in which case it applies to all future compilation units Productivity Consortium, 1992. compiled into the same environment. Ada Language Reference Manual, The consolidated Controlled type: A type descended from the Ada Reference Manual, consisting of the international language-defined type Controlled or standard (ISO/IEC 8652:1995): Information Limited_Controlled. A controlled type is a specialized Technology -- Programming Languages -- Ada, as type in Ada where an implementer can tightly control updated by changes from Technical Corrigendum 1 the initialization, assignment, and finalization of (ISO/IEC 8652:1995:TC1:2000), and Amendment 1 objects of the type. This supports techniques such as (ISO/IEC 8526:AMD1:2007). reference counting, hidden levels of indirection, reliable resource allocation, etc. IEEE 754-2008, IEEE Standard for Binary Floating Point Arithmetic, IEEE, 2008. Discrete type: An integer type or an enumeration type. IEEE 854-1987, IEEE Standard for Radix- Independent Floating-Point Arithmetic, IEEE, 1987. 3 Discriminant: A parameter for a composite type. It Pragma Discard_Names: Specifies that storage used can control, for example, the bounds of a component at run-time for the names of certain entities may be of the type if the component is an array. A reduced. discriminant for a task type can be used to pass data Pragma Export: Specifies an Ada entity to be to a task of the type upon creation. accessed by a foreign language, thus allowing an Ada subprogram to be called from a foreign language, or Erroneous execution: The unpredictable result arising an Ada object to be accessed from a foreign from an error that is not bounded by the language, but language. that, like a bounded error, need not be detected by the implementation either prior to or during run time. Pragma Import: Specifies an entity defined in a foreign language that may be accessed from an Ada Exception: Represents a kind of exceptional program, thus allowing a foreign-language situation. There are set of predefined exceptions in subprogram to be called from Ada, or a foreign- Ada in package Standard: Constraint_Error, language variable to be accessed from Ada. Program_Error, Storage_Error, and Tasking_Error; one of them is raised when a language-defined check fails. Pragma Normalize_Scalars: A configuration pragma that specifies that an otherwise uninitialized scalar Expanded name: A variable V inside subprogram S object is set to a predictable value, but out of range if in package P can be named V, or P.S.V. The name V possible. is called the direct name while the name P.S.V is called the expanded name. Pragma Pack: Specifies that storage minimization should be the main criterion when selecting the Idempotent behaviour: The property of an operations representation of a composite type. that has the same effect whether applied just once or multiple times. An example would be an operation Pragma Restrictions: Specifies that certain language that rounded a number up to the nearest even integer features are not to be used in a given application. For greater than or equal to its starting value. example, the pragma Restrictions (No_Obsolescent_Features) prohibits the use of any Implementation defined: Aspects of semantics of the deprecated features. This pragma is a configuration language specify a set of possible effects; the pragma which means that all program units compiled implementation may choose to implement any effect into the library must obey the restriction. in the set. Implementations are required to document their behaviour in implementation-defined situations. Pragma Suppress: Specifies that a run-time check need not be performed because the programmer Modular type: A modular type is an integer type with asserts it will always succeed. values in the range 0 .. modulus - 1. The modulus of a modular type can be up to 2**N for N-bit word Pragma Unchecked_Union: Specifies an interface architectures.