AwesomeREA.org

Tool

cwe_checker

Static analyzer from Fraunhofer FKIE that searches binary executables, mainly Linux and Unix ELF files, for code paths matching Common Weakness Enumeration bug classes such as buffer overflows, use-after-free and double free, NULL pointer dereferences, format strings and integer overflows. Ghidra disassembles the binary into a common intermediate representation on which its checks run, from simple heuristics to abstract-interpretation data-flow analysis, so it covers the CPU architectures Ghidra supports, including x86, ARM, MIPS and PowerPC. Warnings are printed as text or JSON, and a bundled Ghidra script annotates them in the disassembly for manual review.

Requirements and limitations

  • Latest stable release at review: v0.9, published 2024-08-20 as a source release. Prebuilt Docker images on the GitHub container registry are tagged latest (master), stable and v0.9 and are x86 only, although the image can be built natively on ARM. The reviewed master commit is 97 commits after v0.9; CHANGES.md labels it 0.10-dev, with a rewritten P-Code extractor and support for more architectures through a Ghidra update, while the crate manifests still say 0.9.0 and the online documentation covers the stable version.
  • Local builds need Rust 1.82+ and a Ghidra 10.2+ installation, which make all locates when GHIDRA_PATH is omitted; the Docker image builds on a Ghidra 11.2.1 headless base, and a Nix flake is also provided. Checks are tuned through src/config.json. Analysis of Linux loadable kernel modules, which runs a subset of the checks with its own configuration, and of bare-metal binaries, which needs a per-device configuration such as the bundled STM32F407VG example, is experimental.
  • Each run takes one binary supplied by the user. The README warns that both false positives and false negatives are to be expected and keeps the CWE-78 OS command injection check disabled on standard runs, so warnings mark code paths for manual review rather than confirmed vulnerabilities. It is also integrated as a plugin in FACT.
  • LGPL-3.0; the README notice allows version 3 or later. Nothing was built and no binaries were analyzed.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · fkie-cad/cwe_checker · Revision 7288311
  2. README.md#L35-L97 GitHub · fkie-cad/cwe_checker · Revision 7288311
  3. README.md#L105-L140 GitHub · fkie-cad/cwe_checker · Revision 7288311
  4. CHANGES.md GitHub · fkie-cad/cwe_checker · Revision 7288311
  5. Dockerfile GitHub · fkie-cad/cwe_checker · Revision 7288311
  6. src/caller/Cargo.toml GitHub · fkie-cad/cwe_checker · Revision 7288311
  7. bare_metal/stm32f407vg.json GitHub · fkie-cad/cwe_checker · Revision 7288311
  8. LICENSE GitHub · fkie-cad/cwe_checker · Revision 7288311
  9. https://github.com/fkie-cad/cwe_checker/releases/tag/v0.9
  10. https://docs.cwe-checker.io/index.html