A Robust and Efficient Defense against Use-after-Free Exploits via Concurrent Pointer Sweeping

Liu, Daiping; Zhang, Mingwei; Wang, Haining

doi:10.1145/3243734.3243826

Cited by 22 publications

(36 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We first look at the overheads of MarkUs in terms of memory and performance, contrasting them with other state-of-the-art use-after-free protections [4], [6], [7], [23]. We then take an indepth look at how we can trade off overheads within MarkUs, and the improvements rendered by the optimisations described in section III.…”

Section: Discussionmentioning

confidence: 99%

“…By comparison, while MarkUs is allowed to use the resources of other CPUs, the additional utilisation is typically negligible. In addition, MarkUs also compares favorably in terms of memory and performance against the higher-overhead techniques presented in the paper [23].…”

Section: Methodsmentioning

confidence: 95%

“…For comparison, we evaluate against results taken from Oscar [7], Dhurjati and Adve [6], Dangsan [4], CRCount [25] and pSweeper [23], on the benchmarks they use. In the latter case, we compare against the pSweeper-1s technique, as this compares most closely to MarkUs in terms of additional CPU costs: overheads for pSweeper-1s on other cores are limited to approximately 30%, rather than the 100% overhead that occurs from the consistent use of a single extra core when pSweeper runs continuously.…”

Section: Methodsmentioning

confidence: 99%

“…Further, most hidden pointers are already carefully implemented, and so are unlikely to contain use-after-free errors. This means the defence is practical, and other techniques that rely on, for example, zeroing old pointers [1], [4], [23], or tracking them [16], are also vulnerable. MarkUs can further successfully protect programs even in the presence of integer-casted or union pointer types that the compiler cannot disambiguate, but MarkUs can treat as potentially containing pointers.…”

Section: Coverage Limitations and Hidden Pointersmentioning

confidence: 99%

See 3 more Smart Citations

MarkUs: Drop-in use-after-free prevention for low-level languages

Ainsworth

Jones

2020

2020 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Use-after-free vulnerabilities have plagued software written in low-level languages, such as C and C++, becoming one of the most frequent classes of exploited software bugs. Attackers identify code paths where data is manually freed by the programmer, but later incorrectly reused, and take advantage by reallocating the data to themselves. They then alter the data behind the program's back, using the erroneous reuse to gain control of the application and, potentially, the system. While a variety of techniques have been developed to deal with these vulnerabilities, they often have unacceptably high performance or memory overheads, especially in the worst case.We have designed MarkUs, a memory allocator that prevents this form of attack at low overhead, sufficient for deployment in real software, even under allocation-and memory-intensive scenarios. We prevent use-after-free attacks by quarantining data freed by the programmer and forbidding its reallocation until we are sure that there are no dangling pointers targeting it. To identify these we traverse live-objects accessible from registers and memory, marking those we encounter, to check whether quarantined data is accessible from any currently allocated location. Unlike garbage collection, which is unsafe in C and C++, MarkUs ensures safety by only freeing data that is both quarantined by the programmer and has no identifiable dangling pointers. The information provided by the programmer's allocations and frees further allows us to optimise the process by freeing physical addresses early for large objects, specialising analysis for small objects, and only performing marking when sufficient data is in quarantine. Using MarkUs, we reduce the overheads of temporal safety in low-level languages to 1.1× on average for SPEC CPU2006, with a maximum slowdown of only 2×, vastly improving upon the state-of-the-art.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 95%

Section: Methodsmentioning

confidence: 99%

Section: Coverage Limitations and Hidden Pointersmentioning

confidence: 99%

See 2 more Smart Citations

MarkUs: Drop-in use-after-free prevention for low-level languages

Ainsworth

Jones

2020

2020 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

show abstract

“…PSweeper [30] achieves concurrent pointer sweeping and object origin tracking to find dangling pointers, which improves the efficiency by sweeping all pointers in a concurrent thread. When a dangling pointer is dereferenced, developers can find the information of the use-after-free behavior by the help of object origin tracking, including where the dangling pointer is dereferenced, and how the object is allocated and freed.…”

Section: B Dangling Pointer Invalidationmentioning

confidence: 99%

Mpchecker: Use-After-Free Vulnerabilities Protection Based on Multi-Level Pointers

et al. 2019

View full text Add to dashboard Cite

Highly efficient languages, such as C/C++, have low-level control over memory. Due to the lack of validity detection for pointers and garbage collection for memory, developers are responsible for dynamic memory management by explicitly allocating and deallocating memory. However, explicit memory management brings a large number of memory safety-related vulnerabilities, such as use-after-free. The threat of use-after-free vulnerabilities has become more and more serious due to their high level of the severity and quick emergence of the number. In this paper, a dynamic defense system is proposed against use-after-free exploits by introducing an approach based on multi-level pointers that insert intermediate pointers between a heap object and its related pointers. First, the relationship between a heap object to be protected, and the related pointers pointing to it, is established by combing with intermediate pointers. Then, all of the accesses to this object via its related pointers can only be achieved through these intermediate pointers. Finally, to prevent the dangling pointers from being dereferenced to this object, all the intermediate pointers related to this object are invalidated when it is freed so that any access to a freed object can be prevented due to the invalidated intermediate pointers. The prototype system MPChecker is implemented, which can prevent use-after-free exploits for C/C++ multi-threaded programs. Compared with the related methods, MPChecker can protect pointers that are copied in a type-unsafe way from being dereferenced to freed objects. In addition, it can also defend against dangling pointers located on the whole memory, including the stack, the heap, and global memory, rather than the heap only. The defense capability is proved by protecting against two exploits to a real-world program, comparing the support of type-unsafe copy with a self-written program. The performance evaluation of MPChecker with some benchmarks, multi-threaded programs, and real-world programs, shows its comparable efficiency.INDEX TERMS Software security, dangling pointers, use-after-free, LLVM.

show abstract

An Efficient Use-after-Free Mitigation Approach via Static Dangling Pointer Nullification

Jia

et al. 2022

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

A Robust and Efficient Defense against Use-after-Free Exploits via Concurrent Pointer Sweeping

Cited by 22 publications

References 39 publications

MarkUs: Drop-in use-after-free prevention for low-level languages

MarkUs: Drop-in use-after-free prevention for low-level languages

Mpchecker: Use-After-Free Vulnerabilities Protection Based on Multi-Level Pointers

An Efficient Use-after-Free Mitigation Approach via Static Dangling Pointer Nullification

Contact Info

Product

Resources

About