Abstract:Software memory disclosure attacks, such as buffer over-read, often work quietly and would cause secret data leakage. The well-known OpenSSL Heartbleed vulnerability leaked out millions of servers' private keys, which caused most of the Internet services insecure at that time. Existing solutions are either hard to apply to large code bases (e.g., through formal verification [20] or symbolic execution [8] on program code), or too heavyweight (e.g., by involving a hypervisor software [23], [24] or a modified operating system kernel [17]). In this paper, we propose SecretSafe, a lightweight and easy-to-use system which leverages the traditional x86 segmentation mechanism to isolate the application secrets from the remaining data. Software developers could prevent the secrets from being leaked out by simply declaring the secret variables with SECURE keyword. Our customized compiler will automatically separate the secrets from the remaining non-secret data with an isolated memory segment. Any legal instructions that have to access the secrets will be automatically instrumented to enable accesses to the isolated segment. We have implemented a SecretSafe prototype with the open source LLVM compiler framework. The evaluation shows that SecretSafe is both secure and efficient.

Detecting heap smashing attacks through fault containment wrappers

HeapTherapy: An Efficient End-to-End Solution against Heap Buffer Overflows

Detection of buffer overflow by duplication of control flow data

A Segment-based Approach of Defending Against Buffer Overflow Attacks

SafeStack: Automatically Patching Stack-Based Buffer Overflow Vulnerabilities

Buffer overflow protection based on adjusting code segment limit

Heapdefender: A Mechanism of Defending Embedded Systems Against Heap Overflow Via Hardware

Buffer Overflow Attacks Defending Using A Segment-Based Approach

Buffer Overflow Protection Based on Segment Limitation

LibsafeXP: A Practical and Transparent Tool for Run-time Buffer Overflow Preventions

A Practical Online Approach to Protecting Kernel Heap Buffers in Kernel Modules

Anti-address flooding algorithm for buffer stack overflow

Real-time Detection Method of Buffer Overflow Attacks

Defending Against the Buffer Overflows: A Static Approach Using Proof-Carrying Code

To Detect Stack Buffer Overflow with Polymorphic Canaries

SecretSafe: A Lightweight Approach against Heap Buffer Over-Read Attack

Method of Preventing Buffer Overflow Attacks by Intercepting DLL Functions

Efficient Array & Pointer Bound Checking Against Buffer Overflow Attacks via Hardware/Software

Dynamic Stack Buffer Overflow Prevention Based on Protection of Control-Flow Data

Buffer Overflow Attacks Analysis and Real-time Detection

Security Protection and Checking in Embedded System Integration Against Buffer Overflow Attacks