Large-scale Debloating of Binary Shared Libraries

Abstract

Developers nowadays have access to an arsenal of toolkits and libraries for rapid application prototyping. However, when an application loads a library, the entirety of that library’s code is mapped into the process address space, even if only a single function is actually needed. The unused portion is bloat that can negatively impact software defenses by unnecessarily inflating their overhead or increasing the attack surface. In this article, we investigate whether debloating is possible and practical at the binary level. To this end, we present Nibbler : a system that identifies and erases unused functions within dynamic shared libraries. Nibbler works in tandem with defenses such as continuous code re-randomization and control-flow integrity, enhancing them without incurring additional run-time overhead. We developed and tested a prototype of Nibbler on x86-64 Linux; Nibbler reduces the size of shared libraries and the number of available functions, for real-world binaries and the SPEC CINT2006 suite, by up to 56% and 82%, respectively. We also demonstrate that Nibbler benefits defenses by showing that: (i) it improves the deployability of a continuous re-randomization system for binaries, namely, Shuffler, by increasing its efficiency by 20%, and (ii) it improves certain fast but coarse and context-insensitive control-flow integrity schemes by reducing the number of gadgets reachable through indirect branch instructions by 75% and 49%, on average. Last, we apply Nibbler on ≈30K C/C++ binaries and ≈5K unique dynamic shared libraries (i.e., almost the complete set of the Debian sid distribution), as well as on nine official Docker images (with millions of downloads in Docker Hub), reporting entrancing findings regarding code bloat at large.

A Longitudinal Analysis of Bloated Java Dependencies

“…In contrast, our study focuses on the evolution and the emergence of bloat in Java projects, while spotting some of the current research gaps and tooling for effective dependency management. Other studies have focused on eliminating bloat in source code [33], binary shared libraries [1], highly configurable programs [15], or containers [24]. Other works have focused on improving the debloat process through various optimizations techniques [2,3,11,31,35].…”

“…In this work, we consider a software project as a collection of Java source code files and configuration files organized to be build with Maven. 1 In this section, we present the key concepts for the analysis of a project 𝑝 in the context of the set of its software dependencies, denoted as D.…”

Egalito

“…Debloating We implemented a function-level debloating [2,14] tool for x86_64 and ARM64. Starting from the program entry point and from every function whose address is taken, this tool iterates over our control-flow graph and finds all reachable code.…”

“…We implemented inplace randomization [44], and a JIT-Shuffling continuous randomization technique (based on Shuffler [61] and TASR [8]). We also implemented debloating [2,14], where unneeded code is removed from the program to improve security. Finally, control-flow integrity (CFI) is another code-reuse defense, where the target of every indirect control flow is validated [1,31,48].…”

Guided linking: dynamic linking without the costs

“…Guided linking can sometimes replace dynamic relocations with static references; in other cases, caching can be combined with our system for an additional performance gain. [Agadakos et al 2019;Davidsson et al 2019;Mulliner and Neugschwandtner 2015;Ziegler et al 2019]. The primary goal is to improve security by reducing the attack surface, with code size reduction as a secondary goal.…”