Intel MPX Explained

Abstract

Memory-safety violations are the primary cause of security and reliability issues in software systems written in unsafe languages. Given the limited adoption of decades-long research in software-based memory safety approaches, as an alternative, Intel released Memory Protection Extensions (MPX)---a hardware-assisted technique to achieve memory safety. In this work, we perform an exhaustive study of Intel MPX architecture along three dimensions: (a) performance overheads, (b) security guarantees, and (c) usability issues. We present the first detailed root cause analysis of problems in the Intel MPX architecture through a cross-layer dissection of the entire system stack, involving the hardware, operating system, compilers, and applications. To put our findings into perspective, we also present an in-depth comparison of Intel MPX with three prominent types of software-based memory safety approaches. Lastly, based on our investigation, we propose directions for potential changes to the Intel MPX architecture to aid the design space exploration of future hardware extensions for memory safety.

Deciding memory safety for single-pass heap-manipulating programs

“…Dynamic analysis techniques as in [Nethercote and Seward 2007;Rosu et al 2009;Serebryany et al 2012] instrument program executables and report errors as they occur during program execution. Recently, there has also been emerging interest in enforcing runtime memory safety using hardware and software support for tagged memory [Joannou et al 2017;lowRISC 2019;Oleksenko et al 2018;Serebryany et al 2018;Watson et al 2015].…”

Context-Aware Failure-Oblivious Computing as a Means of Preventing Buffer Overflows

“…We configured JMeter to use 4 threads, each of which each sent 250 requests to simulate multiple concurrent users using the built-in FTP sampler and the UDP Protocol Support plugin. As the Intel MPX instructions are not thread-safe [19], we also evaluated all tools using only 1 thread. We performed each measurement 10 times to account for variability.…”

“…SoftBound in its original and introspection versions detected memory safety errors in all but one benchmark (458.sjeng), which were presumably false positives. MPX had an additional known false positive [19] in one benchmark (429.mcf), so we excluded this benchmark for MPX. Figure 2 shows the execution times of the SPECInt2006 benchmarks relative to Clang -O3 as a baseline.…”

“…We show how the introspection interface can be used to implement a failure-oblivious computing mechanism. We evaluated our approach by demonstrating that introspection for preventing buffer overflows can be implemented in popular bug-finding and bug-mitigation tools such as LLVM's AddressSanitizer [27], SoftBound [15], and GCC's Pointer Bounds Checker, which is based on the Intel Memory Protection Extensions (MPX) [19]. Furthermore, we show how our approach allows execution to continue in the presence of buffer overflows found in real-world programs as described by the Common Vulnerabilities and Exposures (CVE) database [33], and demonstrate that the performance overhead for introspection implemented in approaches such as MPX is negligible.…”

“…Intel MPX is an instruction set extension that adds instructions for creating, maintaining, and checking bounds information. Although its performance overhead is relatively high [19], providing buffer overflow protection at the hardware level is a promising research direction [35]. To use Intel MPX, we relied on GCC's Pointer Bounds Checker instrumentation, which employs Intel MPX to verify bounds.…”