Effective Memory Protection Using Dynamic Tainting James Clause - - PowerPoint PPT Presentation

▶
effective memory protection using dynamic tainting
SMART_READER_LITE
LIVE PREVIEW

Effective Memory Protection Using Dynamic Tainting James Clause - - PowerPoint PPT Presentation

Apr 10, 2023 664 likes •1.87k views

Effective Memory Protection Using Dynamic Tainting James Clause Ioanis Doudalis and Alessandro Orso Milos Prvulovic (software) (hardware) College of Computing Georgia Institute of Technology Supported in part by: NSF awards CCF-0541080

slide-1
SLIDE 1

College of Computing Georgia Institute of Technology

Supported in part by: NSF awards CCF-0541080 and CCR-0205422 to Georgia Tech, DHS and US Air Force Contract No. FA8750-05-2-0214

Effective Memory Protection Using Dynamic Tainting

Ioanis Doudalis Milos Prvulovic

(hardware)

James Clause Alessandro Orso

(software)

and

slide-2
SLIDE 2

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

slide-3
SLIDE 3

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

slide-4
SLIDE 4

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

slide-5
SLIDE 5

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n:

slide-6
SLIDE 6

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n:

slide-7
SLIDE 7

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n:

slide-8
SLIDE 8

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n:

slide-9
SLIDE 9

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 3

slide-10
SLIDE 10

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 3

slide-11
SLIDE 11

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 3

slide-12
SLIDE 12

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 3

slide-13
SLIDE 13

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 9 3

slide-14
SLIDE 14

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 9 8 2 3 2

slide-15
SLIDE 15

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

i <= n ➜ i < n buf: np: i: n: 9 8 2 3 2

slide-16
SLIDE 16

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 9 8 2 3 2

slide-17
SLIDE 17

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 9 8 2 3 2

slide-18
SLIDE 18

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 9 8 2 3 3 7

slide-19
SLIDE 19

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 9 8 2 3 3 7

slide-20
SLIDE 20

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

Illegal memory accesses (IMA)

Memory

buf: np: i: n: 9 8 2 3 3 7

Illegal memory accesses

  • Caused by common programming mistakes
  • Cause non-deterministic failures
  • Cause security vulnerabilities
slide-21
SLIDE 21

Previous work

Static techniques

  • Language based

e.g., Jim et al. 02, Necula et al. 05

  • Analysis based

e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03

Dynamic techniques

  • Analysis based

e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05

  • Hardware based

e.g., Qin et al. 05, Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07, Vachharajani et al. 04

slide-22
SLIDE 22

Previous work

Static techniques

  • Language based

e.g., Jim et al. 02, Necula et al. 05

  • Analysis based

e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03

Dynamic techniques

  • Analysis based

e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05

  • Hardware based

e.g., Qin et al. 05, Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07, Vachharajani et al. 04

}

Require source code

slide-23
SLIDE 23

Previous work

Static techniques

  • Language based

e.g., Jim et al. 02, Necula et al. 05

  • Analysis based

e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03

Dynamic techniques

  • Analysis based

e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05

  • Hardware based

e.g., Qin et al. 05, Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07, Vachharajani et al. 04

}

}

Require source code Unacceptable overhead

slide-24
SLIDE 24

Previous work

Static techniques

  • Language based

e.g., Jim et al. 02, Necula et al. 05

  • Analysis based

e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03

Dynamic techniques

  • Analysis based

e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05

  • Hardware based

e.g., Qin et al. 05, Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07, Vachharajani et al. 04

}

}

Require source code Unacceptable overhead

}

Extensive modification

slide-25
SLIDE 25

Previous work

Static techniques

  • Language based

e.g., Jim et al. 02, Necula et al. 05

  • Analysis based

e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03

Dynamic techniques

  • Analysis based

e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05

  • Hardware based

e.g., Qin et al. 05, Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07, Vachharajani et al. 04

}

}

Require source code Unacceptable overhead We define our approach to overcome these limitations

  • Operate at the binary level
  • Use hardware to reduce overhead
  • Minimal, practical modifications

}

Extensive modification

slide-26
SLIDE 26

Approach overview

slide-27
SLIDE 27

1 Assign

taint marks

Approach overview

slide-28
SLIDE 28

1 Assign

taint marks

Approach overview

P1 A

slide-29
SLIDE 29

P1 1 A 1

1 Assign

taint marks

Approach overview

slide-30
SLIDE 30

1 Assign

taint marks

Approach overview

P1 P2 1 2 A B 1 2

slide-31
SLIDE 31

1 Assign

taint marks

Approach overview

P3 P1 P2 3 1 2 A C B 1 2 3

slide-32
SLIDE 32

1 Assign

taint marks

Approach overview

P3 P1 P2 3 1 2 P5 A C B 1 2 3 P4

slide-33
SLIDE 33

1 Assign

taint marks

Approach overview

2 Propagate

taint marks P3 P1 P2 3 1 2 P5 A C B 1 2 3 P4

slide-34
SLIDE 34

1 Assign

taint marks

Approach overview

2 Propagate

taint marks P3 P1 P2 3 1 2 P5 A C B 1 2 3 P4

slide-35
SLIDE 35

1 Assign

taint marks

Approach overview

2 Propagate

taint marks P3 P1 P2 3 1 2 P5 3 A C B 1 2 3 P4 1

slide-36
SLIDE 36

1 Assign

taint marks

Approach overview

3 Check

taint marks

2 Propagate

taint marks P3 P1 P2 3 1 2 P5 3 A C B 1 2 3 P4 1

slide-37
SLIDE 37

1 Assign

taint marks

Approach overview

3 Check

taint marks

2 Propagate

taint marks P3 P1 P2 3 1 2 P5 3 A C B 1 2 3 P4 1

slide-38
SLIDE 38

1 Assign

taint marks

Approach overview

3 Check

taint marks

2 Propagate

taint marks P3 P1 P2 3 1 2 P5 3 A C B 1 2 3 P4 1

slide-39
SLIDE 39

1 Assign

taint marks

Approach overview

3 Check

taint marks

2 Propagate

taint marks P3 P1 P2 3 1 2 P5 3 A C B 1 2 3 P4 1

slide-40
SLIDE 40

1 Assign

taint marks

Approach overview

3 Check

taint marks

2 Propagate

taint marks P3 P1 P2 3 1 2 A C B 1 2 3 P4 P5 3 1

slide-41
SLIDE 41

1 Assign

taint marks

Approach overview

3 Check

taint marks

2 Propagate

taint marks P3 P1 P2 3 1 2 A C B 1 2 3 P4 P5 3 1

slide-42
SLIDE 42

1 Assign

taint marks

Approach overview

3 Check

taint marks

2 Propagate

taint marks P3 P1 P2 3 1 2 A C B 1 2 3 P4

  • P5

3 1

slide-43
SLIDE 43

Outline

  • Our approach
  • 1. Assigning taint marks
  • 2. Propagating taint marks
  • 3. Checking taint marks
  • Empirical evaluation
  • Conclusions
slide-44
SLIDE 44

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-45
SLIDE 45

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-46
SLIDE 46

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n:

slide-47
SLIDE 47

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n:

{

[&np, &np + sizeof(int *))

slide-48
SLIDE 48

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n:

slide-49
SLIDE 49

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n: 4 3 2 1

slide-50
SLIDE 50

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-51
SLIDE 51

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-52
SLIDE 52

Memory Pointers

1 Assigning taint marks

Static Dynamic

address-of operator (&)

slide-53
SLIDE 53

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-54
SLIDE 54

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n: 4 3 2 1

slide-55
SLIDE 55

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-56
SLIDE 56

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-57
SLIDE 57

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-58
SLIDE 58

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n: 4 2 3 2 1 3

slide-59
SLIDE 59

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n: 4 2 3 2 1 3 [ret, ret + arg0)

{

slide-60
SLIDE 60

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n: 4 2 3 2 1 3

slide-61
SLIDE 61

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n: 4 2 3 2 1 5 5 5 3

slide-62
SLIDE 62

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-63
SLIDE 63

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-64
SLIDE 64

Memory Pointers

1 Assigning taint marks

Static Dynamic

return value of malloc

slide-65
SLIDE 65

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-66
SLIDE 66

Memory Pointers

1 Assigning taint marks

Static Dynamic

buf: np: i: n: 4 2 3 2 1 5 5 5 3

slide-67
SLIDE 67

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-68
SLIDE 68

Memory Pointers

1 Assigning taint marks

Static Dynamic

slide-69
SLIDE 69

AND Addition, Subtraction Overview

Propagating taint marks

2

Multiplication, Division, OR, XOR

Overview P1 1 P2

slide-70
SLIDE 70

AND Addition, Subtraction Overview

Propagating taint marks

2

Multiplication, Division, OR, XOR

Overview

+, , , ÷,

and, or, xor, ... P1 1 P2

slide-71
SLIDE 71

AND Addition, Subtraction Overview

Propagating taint marks

2

Multiplication, Division, OR, XOR

Overview

+, , , ÷,

and, or, xor, ... P1 1 P2 Should the result be tainted? If so, how?

slide-72
SLIDE 72

AND Addition, Subtraction Overview

Propagating taint marks

2

Multiplication, Division, OR, XOR

Overview

  • Propagation must take into account both
  • peration semantics and programmer intent

+, , , ÷,

and, or, xor, ... P1 1 P2 Should the result be tainted? If so, how?

slide-73
SLIDE 73

AND Addition, Subtraction Overview

Propagating taint marks

2

Multiplication, Division, OR, XOR

Overview

  • Propagation must take into account both
  • peration semantics and programmer intent
  • Our policy is based on knowledge of

C/C++/assembly and patterns observed in real software

+, , , ÷,

and, or, xor, ... P1 1 P2 Should the result be tainted? If so, how?

slide-74
SLIDE 74

AND Addition, Subtraction Overview

Propagating taint marks

2

Multiplication, Division, OR, XOR

Addition, Subtraction

A +/− B = C

A B C

Most common use of addition and subtraction is to add or subtract a pointer and an offset 1 1 1

/

1

no taint

...

slide-75
SLIDE 75

AND Addition, Subtraction Overview

Propagating taint marks

2

Multiplication, Division, OR, XOR

AND The result of anding a pointer and a mask should be treated differently depending on the value of the mask c = a & 0xffffff00 - base address c = a & 0x000000ff - offset

A & B = C

A B C

1

  • r

1

no taint

...

slide-76
SLIDE 76

AND Addition, Subtraction Overview

Propagating taint marks

2

Multiplication, Division, OR, XOR Multiplication, Division, OR, XOR

We found zero cases where the result of any of these operations was a pointer

slide-77
SLIDE 77

Checking taint marks

When memory is accessed through a pointer: compare the memory taint mark and the pointer taint mark

3

Pointer Memory IMA?

no yes yes yes yes 1 2 2 2 3 3

slide-78
SLIDE 78

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

slide-79
SLIDE 79

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

slide-80
SLIDE 80

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... }

slide-81
SLIDE 81

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: i: n: 4 3 2 1

slide-82
SLIDE 82

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: i: n: 4 3 2 1

slide-83
SLIDE 83

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: i: n: 4 2 3 2 1

slide-84
SLIDE 84

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: i: n: 4 2 3 2 1

slide-85
SLIDE 85

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: i: n: 4 2 3 2 1

slide-86
SLIDE 86

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: i: n: 4 2 3 2 1

slide-87
SLIDE 87

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: i: n: 4 2 3 2 1

slide-88
SLIDE 88

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: i: n: 4 2 3 2 1 3

slide-89
SLIDE 89

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: i: n: 4 2 3 2 1 3

slide-90
SLIDE 90

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: 5 i: n: 4 2 3 2 1 5 5 5 3

slide-91
SLIDE 91

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: 5 i: n: 4 2 3 2 1 5 5 5 3

slide-92
SLIDE 92

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: 5 i: n: 4 2 3 2 1 5 5 5 3

slide-93
SLIDE 93

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } + = 5 5 buf: np: 5 i: n: 4 2 3 2 1 5 5 5 3

slide-94
SLIDE 94

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } + = 5 5 buf: np: 5 i: n: 4 2 3 2 1 5 5 5 3

slide-95
SLIDE 95

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: 5 i: n: 4 2 3 2 1 5 5 5 3

slide-96
SLIDE 96

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: 5 i: n: 4 2 3 2 1 5 5 5 9 3

slide-97
SLIDE 97

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: 5 i: n: 4 2 3 2 1 5 5 5 9 8 2 3 2

slide-98
SLIDE 98

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: 5 i: n: 4 2 3 2 1 5 5 5 9 8 2 3 2

slide-99
SLIDE 99

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: 5 i: n: 4 2 3 2 1 5 5 5 9 8 2 3 3 + = 5 5

slide-100
SLIDE 100

Preventing IMAs

void main() {

  • 1. int *np, n, i, *buf;
  • 2. np = &n;
  • 3. printf(“Enter size: “);
  • 4. scanf(“%d”, np);
  • 5. buf = malloc(n * sizeof(int));
  • 6. for(i = 0; i <= n; i++)
  • 7. *(buf + i) = rand()%10;

... } buf: np: 5 i: n: 4 2 3 2 1 5 5 5 9 8 2 3 3 + = 5 5

slide-101
SLIDE 101

Limiting the number of taint marks

An unlimited number of taint marks makes a hardware implementation infeasible

  • increases the overhead (time and space)
  • complicates the design
slide-102
SLIDE 102

Limiting the number of taint marks

An unlimited number of taint marks makes a hardware implementation infeasible

  • increases the overhead (time and space)
  • complicates the design

➡ Assign taint marks from a limited, reusable

pool

slide-103
SLIDE 103

Effects on the approach

With an random assignment of n taint marks the

detection probability is:

IMAs are detected probabilistically

p = 1 − 1 n

slide-104
SLIDE 104

Effects on the approach

With an random assignment of n taint marks the

detection probability is:

IMAs are detected probabilistically

2 marks = 50%, 4 marks = 75%, 16 marks = 93.75%, 256 marks = 99.6%

p = 1 − 1 n

slide-105
SLIDE 105

Effects on the approach

With an random assignment of n taint marks the

detection probability is:

  • 1. The technique can be tuned by increasing or decreasing

the number of taint marks

IMAs are detected probabilistically

2 marks = 50%, 4 marks = 75%, 16 marks = 93.75%, 256 marks = 99.6%

p = 1 − 1 n

slide-106
SLIDE 106

Effects on the approach

With an random assignment of n taint marks the

detection probability is:

  • 1. The technique can be tuned by increasing or decreasing

the number of taint marks

  • 2. In practice the approach is successful with only a small

number (2) of taint marks

IMAs are detected probabilistically

2 marks = 50%, 4 marks = 75%, 16 marks = 93.75%, 256 marks = 99.6%

p = 1 − 1 n

slide-107
SLIDE 107

Empirical evaluation

RQ1: Is the efficiency of our approach sufficient for it to be applied to deployed software? RQ2: What is the effectiveness of our technique when using limited number of taint marks?

slide-108
SLIDE 108

RQ1: experimental method

  • Hardware implementation
  • Cycle accurate simuator (SESC)
  • Treat taint marks as first class citizens
  • Subjects
  • SPEC CPU2000 benchmark (12 applications)
  • Calculate the overhead imposed by our

approach for each subject application

slide-109
SLIDE 109

RQ1: experimental method

  • Hardware implementation
  • Cycle accurate simuator (SESC)
  • Treat taint marks as first class citizens
  • Subjects
  • SPEC CPU2000 benchmark (12 applications)
  • Calculate the overhead imposed by our

approach for each subject application

Current implementation assigns taint marks only to dynamically allocated memory, but propagation and checking are fully implemented

slide-110
SLIDE 110

RQ1: results

5 10 15 20 25 30 b z i p 2 c r a f t y e

  • n

g a p g c c g z i p m c f p a r s e r p e r l b m k t w

  • l

f v

  • r

t e x v p r a v e r a g e % overhead (time)

2 marks 8 marks 16 marks 256 marks

slide-111
SLIDE 111

RQ1: results

5 10 15 20 25 30 b z i p 2 c r a f t y e

  • n

g a p g c c g z i p m c f p a r s e r p e r l b m k t w

  • l

f v

  • r

t e x v p r a v e r a g e % overhead (time)

2 marks 8 marks 16 marks 256 marks

  • Even with 256 marks, the average overhead is

in the single digits

slide-112
SLIDE 112

RQ1: results

5 10 15 20 25 30 b z i p 2 c r a f t y e

  • n

g a p g c c g z i p m c f p a r s e r p e r l b m k t w

  • l

f v

  • r

t e x v p r a v e r a g e % overhead (time)

2 marks 8 marks 16 marks 256 marks

  • All attacks were detected with two taint marks
  • Even with 256 marks, the average overhead is

in the single digits

slide-113
SLIDE 113

RQ1: results

5 10 15 20 25 30 b z i p 2 c r a f t y e

  • n

g a p g c c g z i p m c f p a r s e r p e r l b m k t w

  • l

f v

  • r

t e x v p r a v e r a g e % overhead (time)

2 marks 8 marks 16 marks 256 marks

  • All attacks were detected with two taint marks
  • Software-only implementations impose two
  • rders of magnitude more overhead
  • Even with 256 marks, the average overhead is

in the single digits

slide-114
SLIDE 114

RQ2: experimental method

  • Software implementation
  • Binary instrumenter (Pin)
  • Use instrumentation to assign, propagate, and check

taint marks

  • Subjects
  • SPEC CPU2000 benchmark (12 applications)
  • 5 applications with 7 known IMAs
  • Run both each applications protected by our

software implementation and check that only the known illegal memory accesses are detected (5 times)

slide-115
SLIDE 115

RQ2: results

Application IMA location Type Detected bc-1.06 more_arrays: 177 buffer overflow ✔ (5/5) bc-1.06 lookup: 577 buffer overflow ✔ (5/5) gnupg-1.4.4 parse_comment: 2095 integer overflow ✔ (5/5) mutt-1.4.2.li utf8_to_utf7: 199 buffer overflow ✔ (5/5) php-5.2.0 php_char_to_str_ex: 3152 integer overflow ✔ (5/5) pine-4.44 rfc882_cat: 260 buffer overflow ✔ (5/5) squid-2.3 ftpBuildTitleUrl: 1024 buffer overflow ✔ (5/5)

Applications with known IMAs

slide-116
SLIDE 116

RQ2: results

Application IMA location Type Detected bc-1.06 more_arrays: 177 buffer overflow ✔ (5/5) bc-1.06 lookup: 577 buffer overflow ✔ (5/5) gnupg-1.4.4 parse_comment: 2095 integer overflow ✔ (5/5) mutt-1.4.2.li utf8_to_utf7: 199 buffer overflow ✔ (5/5) php-5.2.0 php_char_to_str_ex: 3152 integer overflow ✔ (5/5) pine-4.44 rfc882_cat: 260 buffer overflow ✔ (5/5) squid-2.3 ftpBuildTitleUrl: 1024 buffer overflow ✔ (5/5)

Applications with known IMAs

All attacks were detected with two taint marks

slide-117
SLIDE 117

RQ2: results

Application IMA location Type Detected bc-1.06 more_arrays: 177 buffer overflow ✔ (5/5) bc-1.06 lookup: 577 buffer overflow ✔ (5/5) gnupg-1.4.4 parse_comment: 2095 integer overflow ✔ (5/5) mutt-1.4.2.li utf8_to_utf7: 199 buffer overflow ✔ (5/5) php-5.2.0 php_char_to_str_ex: 3152 integer overflow ✔ (5/5) pine-4.44 rfc882_cat: 260 buffer overflow ✔ (5/5) squid-2.3 ftpBuildTitleUrl: 1024 buffer overflow ✔ (5/5) Application IMA location Type Detected vortex SendMsg: 279 null-pointer dereference ✔ (5/5)

Applications with known IMAs SPEC Benchmarks (“IMA free”)

All attacks were detected with two taint marks

slide-118
SLIDE 118

Future work

  • Complete implementation that handles

static memory

  • Additional experiments with a wider range
  • f IMAs
  • Further optimization of the hardware

implementation

slide-119
SLIDE 119

Conclusions

  • Definition of an approach for preventing illegal

memory accesses in deployed software

  • uses dynamic taint analysis to protect memory
  • uses probabilistic detection to achieve acceptable
  • verhead
  • Empirical evaluation showing that the approach
  • is effective at detecting IMA in real applications
  • can be implemented efficiently in hardware