Abstract:Existing tools for the automated detection of memory corruption bugs are not very effective in practice. They typically recognize only standard memory management (MM) APIs (e.g., malloc and free) and assume a naive paired-use model—an allocator is followed by a specific deallocator. However, we observe that programmers very often design their own MM functions and that these functions often manifest two major characteristics: (1) Custom allocator functions perform multi-object or nested allocation which then requires structure-aware deallocation functions. (2) Custom allocators and deallocators follow an unpaired-use model. A more effective detection thus needs to adapt those characteristics and capture memory bugs related to non-standard MM behaviors. In this paper, we present a MM function aware memory bug detection technique by introducing the concept of structure-aware and object-centric Memory Operation Synopsis (MOS). A MOS abstractly describes the memory objects of a given MM function, how they are managed by the function, and their structural relations. By utilizing MOS, a bug detection could explore much less code but is still capable of handling multi-object or nested allocations and does not rely on the paired-use model. In addition, to extensively find MM functions and automatically generate MOS for them, we propose a new identification approach that combines natural language processing (NLP) and data flow analysis, which enables the efficient and comprehensive identification of MM functions, even in very large code bases. We implement a MOS-enhanced memory bug detection system, Goshawk, to discover memory bugs caused by complex and custom MM behaviors. We applied Goshawk to well-tested and widely-used open source projects including OS kernels, server applications, and IoT SDKs. Goshawk outperforms the state-of-the-art data flow analysis driven bug detection tools by an order of magnitude in analysis speed and the number of accurately identified MM functions, reports the discovered bugs with a developer-friendly, MOS based description, and successfully detects 92 new double-free and use-after-free bugs.

Capturing Invalid Input Manipulations for Memory Corruption Diagnosis

Detection, exploitation and mitigation of memory errors

A Source-Level Instrumentation Framework for the Dynamic Analysis of Memory Safety

MemCloak

A unit-based symbolic execution method for detecting memory corruption vulnerabilities in executable codes

TMAC: Taint-based memory protection via access control

FaultMorse: an Automated Controlled-Channel Attack Via Longest Recurring Sequence

Memory Integrity Techniques for Memory-Unsafe Languages: A Survey

Identifying exploitable memory objects for out‐of‐bound write vulnerabilities

Pointing in the Right Direction - Securing Memory Accesses in a Faulty World

Detecting concurrency memory corruption vulnerabilities.

Goshawk: Hunting Memory Corruptions Via Structure-Aware and Object-Centric Memory Operation Synopsis

Early Detection of In-Memory Malicious Activity based on Run-time Environmental Features

RENN: Efficient Reverse Execution with Neural-Network-assisted Alias Analysis

Physical Memory Attacks and a Memory Safe Management System for Memory Defense

Saturation Memory Access: Mitigating Memory Spatial Errors without Terminating Programs.

Cmad:A C Memory Access Errors Detector Based on Semantics Abstraction

RDAMS: an Efficient Run-Time Approach for Memory Fault and Hardware Trojans Detection

MTSan: A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries

MLD: An Intelligent Memory Leak Detection Scheme Based on Defect Modes in Software

MRm-DLDet: a memory-resident malware detection framework based on memory forensics and deep neural network