A Quantitative Assessment Approach to COTS Component Security

Table 1

Exceptional predication rules and vulnerability factors.

ID	Predication rules	Description	VC
01	General exception	The general exception code is detected, or throw an exception	0.5
02	Access out of range	Running a thread attempts to read or write the memory address, but has no corresponding access authority	1
03	Matrix visited beyond scope	A thread tries to access an array element beyond scope	1
04	Access the memory page not exiting	The file system returns a read error resulting in page fault which can-not meet the requirements	0.8
05	Visit the protected page	A thread tries to access memory page that has the attribute of PAGE_GUARD	1
06	Stack of thread is overflow	A thread runs out of all stack space assigned to it	1
07	Execute illegal instruction	A thread running an instruction that is not allowed in the current thread or executing an invalid instruction	1
08	Divisor is 0	A thread tries to divide an integer or a float by 0	0.8
09	Operation out of range	An operation result exceeds the specified range values	0.8
10	Floating-point stack overflow	Stack overflow or underflow because of floating-point operations	1
11	Buffer overflow	Written contents beyond the buffer length, resulting in written data covering the original return address and destroying the program stack	1
12	Memory leakage	Monitoring the input and output values of malloc(), free(), realloc() functions and making a statistical analysis to achieve a memory leakage check	1
13	Format string exceptions	Format or parameter mismatch when using printf() function, such as “%n%n%s%d”	1