Abstract:In software development, the prevalence of unsafe languages such as C and C++ introduces potential vulnerabilities, especially within the heap, a pivotal component for dynamic memory allocation. Despite its significance, heap management complexities have made heap corruption pervasive, posing severe threats to system security. While prior solutions aiming for temporal and spatial memory safety exhibit overheads deemed impractical, we present ShadowBound, a unique heap memory protection design. At its core, ShadowBound is an efficient out-of-bounds defense that can work with various use-after-free defenses (e.g. MarkUs, FFMalloc, PUMM) without compatibility constraints. We harness a shadow memory-based metadata management mechanism to store heap chunk boundaries and apply customized compiler optimizations tailored for boundary checking. We implemented ShadowBound atop the LLVM framework and integrated three state-of-the-art use-after-free defenses. Our evaluations show that ShadowBound provides robust heap protection with minimal time and memory overhead, suggesting its effectiveness and efficiency in safeguarding real-world programs against prevalent heap vulnerabilities.

What problem does this paper attempt to address?

### Problems the Paper Aims to Solve The paper aims to address the security issues of heap memory management in software development, particularly focusing on the prevalent heap memory vulnerabilities in unsafe languages like C and C++. Although the heap plays a crucial role in dynamic memory allocation, its complexity leads to frequent heap corruption, posing a serious threat to system security. Existing solutions, while providing temporal and spatial memory safety, often come with excessive overhead, making them impractical for real-world applications. **Specific problems include:** 1. **Prevalence and severity of heap memory vulnerabilities**: - The complexity of heap memory management leads to common issues of heap corruption. These vulnerabilities can be exploited to manipulate data, bypass security defenses, and even execute arbitrary code, causing severe impacts on affected systems. 2. **High overhead of existing solutions**: - Although some previous works have successfully provided temporal and spatial memory safety, they typically come with more than 1.5 times the time overhead, making these solutions impractical for real-world applications. 3. **Compatibility issues**: - Most advanced Use-After-Free (UAF) defense mechanisms require the introduction of new allocators, which may conflict with existing heap memory protection mechanisms, limiting their applicability. ### Solution To address the above issues, the paper proposes SHADOW BOUND, an efficient heap memory protection design. The core of SHADOW BOUND is an efficient out-of-bounds defense mechanism that prevents the exploitation of out-of-bounds vulnerabilities by inserting boundary checks and can seamlessly integrate with various UAF defense mechanisms without compatibility concerns. **Key features include:** 1. **Shadow memory management mechanism**: - Uses shadow memory to store the boundary information of each heap block corresponding to a pointer, ensuring that boundary information can be extracted with just one load instruction and a few arithmetic instructions during checks. 2. **Custom compiler optimizations**: - Implements various custom optimizations for boundary checks, significantly reducing time overhead. These optimizations include runtime-driven check elimination, directional boundary checks, and safe mode recognition. 3. **Efficiency and low overhead**: - Experimental results show that SHADOW BOUND provides robust heap memory protection while introducing minimal time and memory overhead, making it suitable for various benchmarks and real-world applications. Through these innovations, SHADOW BOUND aims to provide an efficient and practical heap memory protection mechanism, effectively addressing existing heap memory security challenges.

ShadowBound: Efficient Heap Memory Protection Through Advanced Metadata Management and Customized Compiler Optimization

Top of the Heap: Efficient Memory Error Protection of Safe Heap Objects

CAMP: Compiler and Allocator-based Heap Memory Protection

HeapTherapy: An Efficient End-to-End Solution against Heap Buffer Overflows

Saturation Memory Access: Mitigating Memory Spatial Errors without Terminating Programs.

SJMalloc: the security-conscious, fast, thread-safe and memory-efficient heap allocator

S3Library: Automatically Eliminating C/C++ Buffer Overflow using Compatible Safer Libraries

Detecting heap smashing attacks through fault containment wrappers

HeapSafe: Securing Unprotected Heaps in RISC-V

SuM: Efficient shadow stack protection on ARM Cortex-M

S2malloc: Statistically Secure Allocator for Use-After-Free Protection And More

Safely Abstracting Memory Layouts

SafeMD: Ownership-Based Safe Memory Deallocation for C Programs

Rethinking Misalignment to Raise the Bar for Heap Pointer Corruption

SeMalloc: Semantics-Informed Memory Allocator

Heap Taichi: exploiting memory allocation granularity in heap-spraying attacks

PACSafe: Leveraging ARM Pointer Authentication for Memory Safety in C/C++

Zweilous: A Decoupled and Flexible Memory Management Framework.

PACMem: Enforcing Spatial and Temporal Memory Safety via ARM Pointer Authentication

MIRAGE: Randomizing large chunk allocation via dynamic binary instrumentation

Mesh: Compacting Memory Management for C/C++ Applications