Intel MPX Explained

Oleksenko, Oleksii; Kuvaiskii, Dmitrii; Bhatotia, Pramod; Felber, Pascal; Fetzer, Christof

doi:10.1145/3219617.3219662

Cited by 61 publications

(12 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…450.soplex is incompatible with per-pointer bounds checkers: it patches pointers to point to out-of-bounds locations using pointer subtraction after reallocating a buffer containing pointers. This violation of the C standard is well-documented in related work [26,34], and other researchers either patch or omit these programs as well. In order to avoid the impact of omitting benchmarks on the overall overhead, we wrote small source patches for 403.gcc to configure pointer bitsize at 32 bits and to preserve a pointer tag at a single NULL pointer subtraction, and for 450.soplex to fix the delta tag on patched pointers after realloc.…”

Section: Runtime Performancementioning

confidence: 72%

“…Since our Delta Pointers design records per-pointer metadata, such a feature could easily be added. Such strict enforcement of bounds is knows to cause compatibility problems [7,34].…”

Section: Discussionmentioning

confidence: 99%

“…Because of its limited static analysis, SoftBound suffers from a low compatibility. Intel MPX [34] achieves a similar design with the support of hardware, introduced with the Skylake microarchitecture but incurs high overhead.…”

Section: Related Workmentioning

confidence: 99%

“…Such instrumentation consists of one or more checks, in the form of branches, on either pointer dereferences [11,12,18,26,31,34,37] or pointer arithmetic (e.g., ptr2 = &ptr[offset]) [1,23,38]. Moreover, the metadata describing object bounds must be recorded, propagated and retrieved numerous times, often from memory [18,23,26,31,34,37,38]. Given the many extra branches and memory accesses required, the run-time checks can introduce significant runtime overhead.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Delta pointers

Kroes

Koning

Kouwe

et al. 2018

Proceedings of the Thirteenth EuroSys Conference

View full text Add to dashboard Cite

Despite decades of research, buffer overflows still rank among the most dangerous vulnerabilities in unsafe languages such as C and C++. Compared to other memory corruption vulnerabilities, buffer overflows are both common and typically easy to exploit. Yet, they have proven so challenging to detect in real-world programs that existing solutions either yield very poor performance, or introduce incompatibilities with the C/C++ language standard.We present Delta Pointers, a new solution for buffer overflow detection based on efficient pointer tagging. By carefully altering the pointer representation, without violating language specifications, Delta Pointers use existing hardware features to detect both contiguous and non-contiguous overflows on dereferences, without a single check incurring extra branch or memory access operations. By focusing on buffer overflows rather than other vulnerabilities (e.g., underflows), Delta Pointers offer a unique checkless design to provide high performance while still maintaining compatibility. We show that Delta Pointers are effective in detecting arbitrary buffer overflows and, at 35% overhead on SPEC, offer much better performance than competing solutions. CCS CONCEPTS· Security and privacy → Systems security; Software and application security;

show abstract

Section: Runtime Performancementioning

confidence: 72%

“…Since our Delta Pointers design records per-pointer metadata, such a feature could easily be added. Such strict enforcement of bounds is knows to cause compatibility problems [7,34].…”

Section: Discussionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Delta pointers

Kroes

Koning

Kouwe

et al. 2018

Proceedings of the Thirteenth EuroSys Conference

View full text Add to dashboard Cite

show abstract

“…In addition, the manipulation of a pointer with metadata should be atomic, otherwise, it will lead to false positives or negatives in multi-threading programs. While the Intel MPX has excellent performance, it is deprecated because it does not provide multi-threaded safety [25,28].…”

Section: Introductionmentioning

confidence: 99%

L4 Pointer: An efficient pointer extension for spatial memory safety support without hardware extension

Mok¹,

Cho²

2023

Preprint

View full text Add to dashboard Cite

Since buffer overflow has long been a frequently occurring, high-risk vulnerability, various methods have been developed to support spatial memory safety and prevent buffer overflow. However, every proposed method, although effective in part, has its limitations. Due to expensive boundchecking or large memory intaking for metadata, the softwareonly support for spatial memory safety inherently entails runtime overhead. Contrastingly, hardware-assisted methods are not available without specific hardware assistants. To mitigate such limitations, Herein we propose L4 Pointer, which is a 128-bit pointer extended from normal 64-bit virtual addresses. By using the extra bits and widespread SIMD operations, L4 Pointer shows less slow-down and higher performance without hardware extension than existing methods.

show abstract

Divak: Non-invasive Characterization of Out-of-Bounds Write Vulnerabilities

Hafkemeyer,

Starink,

Continella

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Despite the high level of automation that fuzzing has brought into the vulnerability research process, the assessment of a discovered vulnerability's implications mostly requires human expertise and intuition. A promising approach to reduce such a manual effort is the automatic extraction of vulnerability characteristics that provide vital clues for exploitability. In this work, we focus on out-of-bounds write vulnerabilities and investigate how to automatically distill the set of source codelevel objects affected by such unintended writes. As this poses unique challenges with regard to the invasiveness of the analysis methods, we propose a novel approach that enables monitoring a compiled program for spatial memory safety violations without the need for heavy instrumentation. We implement Divak, a prototype of our design, and we evaluate it on both benchmarks and real-world vulnerabilities, showing that its detection and characterization capabilities outperform instrumentationbased tools in several scenarios, at the cost of an increased overhead.

show abstract

Intel MPX Explained

Cited by 61 publications

References 9 publications

Delta pointers

Delta pointers

L4 Pointer: An efficient pointer extension for spatial memory safety support without hardware extension

Divak: Non-invasive Characterization of Out-of-Bounds Write Vulnerabilities

Contact Info

Product

Resources

About