FreeSentry: Protecting Against Use-After-Free Vulnerabilities Due to Dangling Pointers

Younan, Yves

doi:10.14722/ndss.2015.23190

Cited by 85 publications

(104 citation statements)

References 28 publications

Supporting

Mentioning

104

Contrasting

Order By: Relevance

“…References [9] and [11] detect dangling pointers by a static analysis of a binary program. Reference [12] inserts dynamic runtime checks for protecting against UAF vulnerabilities. This approach requires a source code.…”

Section: Related Workmentioning

confidence: 99%

Mitigating Use-After-Free Attacks Using Memory-Reuse-Prohibited Library

Yamauchi

Ikegami

Ban

2017

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYRecently, there has been an increase in use-after-free (UAF) vulnerabilities, which are exploited using a dangling pointer that refers to a freed memory. In particular, large-scale programs such as browsers often include many dangling pointers, and UAF vulnerabilities are frequently exploited by drive-by download attacks. Various methods to prevent UAF attacks have been proposed. However, only a few methods can effectively prevent UAF attacks during runtime with low overhead. In this paper, we propose HeapRevolver, which is a novel UAF attackprevention method that delays and randomizes the timing of release of freed memory area by using a memory-reuse-prohibited library, which prohibits a freed memory area from being reused for a certain period. The first condition for reuse is that the total size of the freed memory area is beyond the designated size. The threshold for the conditions of reuse of the freed memory area can be randomized by HeapRevolver. Furthermore, we add a second condition for reuse in which the freed memory area is merged with an adjacent freed memory area before release. Furthermore, HeapRevolver can be applied without modifying the target programs. In this paper, we describe the design and implementation of HeapRevolver in Linux and Windows, and report its evaluation results. The results show that HeapRevolver can prevent attacks that exploit existing UAF vulnerabilities. In addition, the overhead is small.

show abstract

Section: Related Workmentioning

confidence: 99%

Mitigating Use-After-Free Attacks Using Memory-Reuse-Prohibited Library

Yamauchi

Ikegami

Ban

2017

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…DieHard(er) [Berger and Zorn 2006;Novark and Berger 2010] and Archipelago [Lvin et al 2008] randomize allocations to make the application less vulnerable to memory attacks. Several systems detect accesses to freed objects [Lee et al 2015;Nagarakatte et al 2010;Younan 2015], but do not provide full type safety.…”

Section: Related Workmentioning

confidence: 99%

Project snowflake: non-blocking safe manual memory management in .NET

Parkinson

Vytiniotis

Vaswani

et al. 2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Garbage collection greatly improves programmer productivity and ensures memory safety. Manual memory management on the other hand often delivers better performance but is typically unsafe and can lead to system crashes or security vulnerabilities. We propose integrating safe manual memory management with garbage collection in the .NET runtime to get the best of both worlds. In our design, programmers can choose between allocating objects in the garbage collected heap or the manual heap. All existing applications run unmodified, and without any performance degradation, using the garbage collected heap. Our programming model for manual memory management is flexible: although objects in the manual heap can have a single owning pointer, we allow deallocation at any program point and concurrent sharing of these objects amongst all the threads in the program. Experimental results from our .NET CoreCLR implementation on real-world applications show substantial performance gains especially in multithreaded scenarios: up to 3x savings in peak working sets and 2x improvements in runtime.

show abstract

“…In addition, a recent study shows that buffer overflows are the commonest vulnerability in the last quarter century [61]. Furthermore, spatial errors persist today, as demonstrated by a recently reported Heartbleed vulnerability in OpenSSL (CVE-2014-0160).…”

Section: Introductionmentioning

confidence: 96%

WPBOUND: Enforcing Spatial Memory Safety Efficiently at Runtime with Weakest Preconditions

Sui

et al. 2014

2014 IEEE 25th International Symposium on Software Reliability Engineering

View full text Add to dashboard Cite

Abstract-Spatial errors (e.g., buffer overflows) continue to be one of the dominant threats to software reliability and security in C/C++ programs. Presently, the software industry typically enforces spatial memory safety by instrumentation. Due to high overheads incurred in bounds checking at runtime, many program inputs cannot be exercised, causing some input-specific spatial errors to go undetected in today's commercial software.This paper introduces a new compile-time optimisation for reducing bounds checking overheads based on the notion of Weakest Precondition (WP). The basic idea is to guard a bounds check at a pointer dereference inside a loop, where the WPbased guard is hoisted outside the loop, so that its falsehood implies the absence of out-of-bounds errors at the dereference, thereby avoiding the corresponding bounds check inside the loop. This WP-based optimisation is applicable to any spatial-error detection approach (in software or hardware or both).To evaluate the effectiveness of our optimisation, we take SOFTBOUND, a compile-time tool with an open-source implementation in LLVM, as our baseline. SOFTBOUND adopts a pointerbased checking approach with disjoint metadata, making it a state-of-the-art tool in providing compatible and complete spatial safety for C. Our new tool, called WPBOUND, is a refined version of SOFTBOUND, also implemented in LLVM, by incorporating our WP-based optimisation. For a set of 12 SPEC C benchmarks evaluated, WPBOUND reduces the average runtime overhead of SOFTBOUND from 71% to 45% (by a reduction of 37%), with small code size increases.

show abstract

FreeSentry: Protecting Against Use-After-Free Vulnerabilities Due to Dangling Pointers

Cited by 85 publications

References 28 publications

Mitigating Use-After-Free Attacks Using Memory-Reuse-Prohibited Library

Mitigating Use-After-Free Attacks Using Memory-Reuse-Prohibited Library

Project snowflake: non-blocking safe manual memory management in .NET

WPBOUND: Enforcing Spatial Memory Safety Efficiently at Runtime with Weakest Preconditions

Contact Info

Product

Resources

About