Abstract:Highly efficient languages, such as C/C++, have low-level control over memory. Due to the lack of validity detection for pointers and garbage collection for memory, developers are responsible for dynamic memory management by explicitly allocating and deallocating memory. However, explicit memory management brings a large number of memory safety-related vulnerabilities, such as use-after-free. The threat of use-after-free vulnerabilities has become more and more serious due to their high level of the severity and quick emergence of the number. In this paper, a dynamic defense system is proposed against use-after-free exploits by introducing an approach based on multi-level pointers that insert intermediate pointers between a heap object and its related pointers. First, the relationship between a heap object to be protected, and the related pointers pointing to it, is established by combing with intermediate pointers. Then, all of the accesses to this object via its related pointers can only be achieved through these intermediate pointers. Finally, to prevent the dangling pointers from being dereferenced to this object, all the intermediate pointers related to this object are invalidated when it is freed so that any access to a freed object can be prevented due to the invalidated intermediate pointers. The prototype system MPChecker is implemented, which can prevent use-after-free exploits for C/C++ multi-threaded programs. Compared with the related methods, MPChecker can protect pointers that are copied in a type-unsafe way from being de-referenced to freed objects. In addition, it can also defend against dangling pointers located on the whole memory, including the stack, the heap, and global memory, rather than the heap only. The defense capability is proved by protecting against two exploits to a real-world program, comparing the support of type-unsafe copy with a self-written program. The performance evaluation of MPChecker with some benchmarks, multi-threaded programs, and real-world programs, shows its comparable efficiency.

CUP: Comprehensive User-Space Protection for C/C++

Kcpa: Towards Sensitive Pointer Full Life Cycle Authentication for OS Kernels

Adaptive Call-Site Sensitive Control Flow Integrity

Tools to Make C Programs Safe: a Deeper Study

CAMP: Compiler and Allocator-based Heap Memory Protection

PACSafe: Leveraging ARM Pointer Authentication for Memory Safety in C/C++

CryptSan: Leveraging ARM Pointer Authentication for Memory Safety in C/C++

Top of the Heap: Efficient Memory Error Protection of Safe Heap Objects

PACSan: Enforcing Memory Safety Based on ARM PA

Memory Errors Prevention Technology for C/C++ Program Based on Probability

PACMem: Enforcing Spatial and Temporal Memory Safety via ARM Pointer Authentication

Memory errors prevention technology for C/C++ program based on probability.

Taming the War in Memory: A Resilient Mitigation Strategy Against Memory Safety Attacks in CPS

CToMP: a cycle-task-oriented memory protection scheme for unmanned systems

CGuard: Efficient Spatial Safety for C

Securing c programs by dynamic type checking

Mpchecker: Use-After-Free Vulnerabilities Protection Based on Multi-Level Pointers

A Source-Level Instrumentation Framework for the Dynamic Analysis of Memory Safety

Practical Control Flow Integrity and Randomization for Binary Executables

S3Library: Automatically Eliminating C/C++ Buffer Overflow using Compatible Safer Libraries

ShadowBound: Efficient Heap Memory Protection Through Advanced Metadata Management and Customized Compiler Optimization