PACMem

Li, Yuan; Tan, Wende; Lv, Zhizheng; Yang, Songtao; Payer, Mathias; Liu, Ying; Zhang, Chao

doi:10.1145/3548606.3560598

Cited by 14 publications

(5 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Redzone-Based Sanitizer vs. Pointer-Based Sanitizer. Many address sanitizers have been proposed [70], [79], [33], [72], [56], [57], [58], [51], [90], [42], [20]. Two designs receive wide adoption: redzone-based solutions such as ASan [70] and pointer-based solutions such as CCured [58].…”

Section: Memory Bugs and Bug-oriented Program Analysismentioning

confidence: 99%

“…More specifically, what are the rates of false positives (FP) and false negatives (FN)? In a related work (PACMem [51]), two benchmark suites were used to quantitatively evaluate the proposed sanitizer. They are the Juliet Test Suite [59] and Magma [39].…”

Section: A Sanitizer Capabilitymentioning

confidence: 99%

“…Although our result is promising, we note that in theory IPEA-San may also suffer from both FPs and FNs due to the unsound static analysis. The Juliet Test Suite-with enough sophistication and also used in related work to evaluate sanitizer capability [51]-just cannot trigger the deficiency of IPEA-San. We discuss more details about IPEA-San limitations in §IX.…”

Section: A Sanitizer Capabilitymentioning

confidence: 99%

“…The memory overhead introduced by ASan transforms to significant performance slowdown during sanitizer setup/teardown [42]. Therefore, recent work tries to reduce metadata with optimized data structure [42], [20] or by leveraging hardware features [79], [51], [89]. ASan for MCUs ported in this work actually incorporates the idea of FuZZan [42] to reduce the address space of the target firmware.…”

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Facilitating Non-Intrusive In-Vivo Firmware Testing with Stateless Instrumentation

Shi,

Li,

Wang

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Although numerous dynamic testing techniques have been developed, they can hardly be directly applied to firmware of deeply embedded (e.g., microcontroller-based) devices due to the tremendously different runtime environment and restricted resources on these devices. This work tackles these challenges by leveraging the unique position of microcontroller devices during firmware development. That is, firmware developers have to rely on a powerful engineering workstation that connects to the target device to program and debug code. Therefore, we develop a decoupled firmware testing framework named IPEA, which shifts the overhead of resource-intensive analysis tasks from the microcontroller to the workstation. Only lightweight "needle probes" are left in the firmware to collect internal execution information without processing it. We also instantiated this framework with a sanitizer based on pointer capability (IPEA-San) and a greybox fuzzer (IPEA-Fuzz). By comparing IPEA-San with a port of AddressSanitizer for microcontrollers, we show that IPEA-San reduces memory overhead by 62.75% in real-world firmware with better detection accuracy. Combining IPEA-Fuzz with IPEA-San, we found 7 zero-day bugs in popular IoT libraries (3) and peripheral driver code (4).

show abstract

Section: Memory Bugs and Bug-oriented Program Analysismentioning

confidence: 99%

Section: A Sanitizer Capabilitymentioning

confidence: 99%

Section: A Sanitizer Capabilitymentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Facilitating Non-Intrusive In-Vivo Firmware Testing with Stateless Instrumentation

Shi,

Li,

Wang

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…ViK [16] also identifies all allocation and pointer dereference sites statically and instruments code to track and examine metadata for use-afterfree mitigation. PACMem [24] uses ARM's architectural feature called Pointer Authentication to reduce the overhead of pointer metadata tracking when defeating temporal safety violations.…”

Section: Related Workmentioning

confidence: 99%

Efficient Use-After-Free Prevention with Opportunistic Page-Level Sweeping

Park,

Moon

2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Defeating use-after-free exploits presents a challenging problem, one for which a universal solution remains elusive. Recent efforts towards efficient prevention of use-after-free exploits have found that delaying the reuse of freed memory can both be effective and efficient in many cases. Previous studies have proposed two primary approaches: one where reuse is postponed until the allocator can confidently ascertain the absence of any dangling pointers to the freed memory, and another that refrains from reusing a freed heap chunk until the program's termination. We make an intriguing observation from our in-depth analysis of these two approaches and their reported performance impacts. When compared to the design that delays the reuse until the program terminates the strategy that delays the reuse just until no dangling pointer references the freed chunk suffers from a significant performance overhead for some workloads. The change in the reuse of each heap chunk affects the distribution of allocated chunks in the heap, and the performance of some benchmarks. This study proposes HUSHVAC, an allocator that performs delayed reuse in such a way that the distribution of heap chunks becomes more friendly to such workloads. An evaluation of HUSHVAC showed that the average performance overhead of HUSHVAC (4.7%) was lower than that of the state-of-the-art (11.4%) when running the SPEC CPU 2006 benchmark suite. Specifically, the overhead of HUSHVAC on the distribution-sensitive benchmark was about 35.2% while the prior work has an overhead of 110%.

show abstract