VIP: Safeguard Value Invariant Property for Thwarting Critical Memory Corruption Attacks

Ismail, Mohannad; Yom, Jinwoo; Jelesnianski, Christopher; Jang, Yeongjin; Min, Changwoo

doi:10.1145/3460120.3485376

Cited by 6 publications

(3 citation statements)

References 63 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are previous studies to enhance memory safety. VIP [26] protects heap metadata through a virtual address with Intel MPK and builds a defense against an attack that tampers the CFI or executes arbitrary code that leverages metadata corruption vulnerabilities and heap overflow. This protection methodology relied on the x86 architecture.…”

Section: B Memory Hardeningmentioning

confidence: 99%

“…The metaSafer methodology represents a novel approach aimed at identifying instances of metadata corruption within the Wasm environment. Its primary objective differs from methodologies [26], [27], [28] utilized in other domains and environments(x86) or those reliant on hardware-based protection mechanisms. Since Wasm takes a memory access method through metadata in a unique structure called linear memory, this paper suggests the need for a new protection technique suitable for Wasm linear memory, rather than protection that reuses existing protection techniques.…”

Section: B Memory Hardeningmentioning

confidence: 99%

See 1 more Smart Citation

metaSafer: A Technique to Detect Heap Metadata Corruption in WebAssembly

Song,

Park,

Kwon

2023

IEEE Access

View full text Add to dashboard Cite

WebAssembly (Wasm), a technology enabling efficient native code execution in web browsers, has seen a significant rise in adoption as a popular compilation target. This has led to the emergence of lightweight web services powered by Wasm, characterized by their small binary size and reduced data transfer overhead, thanks to the inherent efficiency of Wasm. Despite their lightweight nature, these services can deliver powerful features like image/video processing, AI and graphical application that surpass the capabilities of JavaScript. To ensure lightweight web services and enhance the overall web experience, Wasm has been extensively optimized. However, these optimizations have raised concerns about memory safety, leading to memory-related vulnerabilities. Wasm's characteristic memory structure, linear memory, has vulnerabilities that provide various attack vectors to attackers. In particular, it presents various attack possibilities through metadata modification containing memory structure information. Attackers can exploit heap memory overflow in Wasm applications, allowing them to target arbitrary memory addresses, modify data, or execute arbitrary code. Such overflows can corrupt memory metadata, resulting in incorrect memory behavior. While research has mitigate memory-related weaknesses in languages such as C and C++ and architectures like X86 in recent decades, the direct application of security solutions designed for different domains to Wasm is not a practical approach. Consequently, allocators in Wasm remain vulnerable to issues like heap overflow and metadata corruption. Thus, there is a pressing need for tailored memory safety techniques and solutions that accommodate Wasm's architecture-agnostic and linear memory structures. In this paper, we propose metaSafer as a solution. By shadowing metadata from Wasm linear memory to JavaScript virtual machine memory and conducting metadata verification, metaSafer effectively blocks attack attempts and vectors. Notably, our solution achieves fast memory shadowing and validation while maintaining a small code size. Through various verification processes, we measured the performance and code size of metaSafer, revealing that it is a software-only security solution with no additional hardware requirements. metaSafer demonstrates robust metadata protection for Wasm applications with an acceptable performance overhead of up to 8% in SQLite speed tests and Polybench benchmarks.

show abstract

Section: B Memory Hardeningmentioning

confidence: 99%

Section: B Memory Hardeningmentioning

confidence: 99%

metaSafer: A Technique to Detect Heap Metadata Corruption in WebAssembly

Song,

Park,

Kwon

2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Some memory isolation schemes leverage PKU to isolate trusted from untrusted components [33,39,40,48,63]. These systems typically tag memory pages containing trusted code and data with a different protection key than pages containing untrusted code, thereby placing them in different memory protection domains.…”

Section: Pku-based Memory Isolation Schemesmentioning

confidence: 99%

You shall not (by)pass!

Voulimeneas

Vinck

Mechelinck

et al. 2022

Proceedings of the Seventeenth European Conference on Computer Systems

View full text Add to dashboard Cite

Memory Protection Keys for Userspace (PKU) is a recent hardware feature that allows programs to assign virtual memory pages to protection domains, and to change domain access permissions using inexpensive, unprivileged instructions. Several in-process memory isolation approaches leverage this feature to prevent untrusted code from accessing sensitive program state and data. Typically, PKU-based isolation schemes need to be used in conjunction with mitigations such as CFI because untrusted code, when compromised, can otherwise bypass the PKU access permissions using unprivileged instructions or operating system APIs.Recently, researchers proposed fully self-contained PKUbased memory isolation schemes that do not rely on other mitigations. These systems use exploit-proof call gates to transfer control between trusted and untrusted code, as well as a sandbox that prevents tampering with the PKU infrastructure from untrusted code.In this paper, we show that these solutions are not complete. We first develop two proof-of-concept attacks against a state-of-the-art PKU-based memory isolation scheme. We then present Cerberus, a PKU-based sandboxing framework that can overcome limitations of existing sandboxes. We apply Cerberus to several memory isolation schemes, and show that it is practical, efficient, and secure.

show abstract