Preventing Use-after-free with Dangling Pointers Nullification - - PowerPoint PPT Presentation

▶
preventing use after free with dangling pointers
SMART_READER_LITE
LIVE PREVIEW

Preventing Use-after-free with Dangling Pointers Nullification - - PowerPoint PPT Presentation

Jul 22, 2023 482 likes •926 views

Preventing Use-after-free with Dangling Pointers Nullification Byoungyoung Lee , Chengyu Song, Yeongjin Jang Tielei Wang, Taesoo Kim, Long Lu, Wenke Lee Georgia Institute of Technology Stony Brook University Emerging Threat: Use-after-free

slide-1
SLIDE 1

Preventing Use-after-free with Dangling Pointers Nullification

Byoungyoung Lee, Chengyu Song, Yeongjin Jang Tielei Wang, Taesoo Kim, Long Lu, Wenke Lee

Georgia Institute of Technology Stony Brook University

slide-2
SLIDE 2

Emerging Threat: Use-after-free

2

Software Vulnerability Exploitation Trends, Microsoft, 2013

slide-3
SLIDE 3

Emerging Threat: Use-after-free

2

Software Vulnerability Exploitation Trends, Microsoft, 2013

slide-4
SLIDE 4

Emerging Threat: Use-after-free

2

Software Vulnerability Exploitation Trends, Microsoft, 2013

slide-5
SLIDE 5

Emerging Threat: Use-after-free

3

Use-after-free Stack Overflow Heap Overflow Security-Critical Security-High

13 582 12 107 The number of reported vulnerabilities in Chrome (2011-2013)

slide-6
SLIDE 6

Emerging Threat: Use-after-free

3

Use-after-free Stack Overflow Heap Overflow Security-Critical Security-High

13 582 12 107 The number of reported vulnerabilities in Chrome (2011-2013)

slide-7
SLIDE 7

Use-after-free

  • A dangling pointer

– A pointer points to a freed memory region

  • Using a dangling pointer leads to undefined

program states

– May lead to arbitrary code executions – so called use-after-free

4 Preventing Use-after-free with Dangling Pointers Nullification

slide-8
SLIDE 8

class Doc : public Element { // … Element *child; }; class Body : public Element { // … Element *child; }; Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign();

Understanding Use-after-free

5 Preventing Use-after-free with Dangling Pointers Nullification

slide-9
SLIDE 9

Understanding Use-after-free

*doc *body Doc Body Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); *child *child

Allocate objects

6 Preventing Use-after-free with Dangling Pointers Nullification

slide-10
SLIDE 10

Understanding Use-after-free

*doc *body Doc Body Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); *child *child

Propagate pointers Allocate objects

6 Preventing Use-after-free with Dangling Pointers Nullification

slide-11
SLIDE 11

Understanding Use-after-free

*doc *body Doc Body Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); *child *child

Propagate pointers Allocate objects

6 Preventing Use-after-free with Dangling Pointers Nullification

slide-12
SLIDE 12

Understanding Use-after-free

*doc *body Doc Body Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); *child *child

Free an object Propagate pointers Allocate objects

6 Preventing Use-after-free with Dangling Pointers Nullification

slide-13
SLIDE 13

Understanding Use-after-free

*doc *body Doc Body Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); *child *child

freed Free an object Propagate pointers Allocate objects

6 Preventing Use-after-free with Dangling Pointers Nullification

slide-14
SLIDE 14

Understanding Use-after-free

*doc *body Doc Body Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); *child *child

freed Free an object Propagate pointers Allocate objects a dangling pointer

6 Preventing Use-after-free with Dangling Pointers Nullification

slide-15
SLIDE 15

Understanding Use-after-free

*doc *body Doc Body Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); *child *child

freed Use a dangling pointer Free an object Propagate pointers Allocate objects a dangling pointer

6 Preventing Use-after-free with Dangling Pointers Nullification

slide-16
SLIDE 16

Understanding Use-after-free

*doc *body Doc Body Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); *child *child

freed Use a dangling pointer Free an object Propagate pointers Allocate objects a dangling pointer

6 Preventing Use-after-free with Dangling Pointers Nullification

slide-17
SLIDE 17

Why use-after-free is challenging

Doc *doc = new Doc(); Body *body = new Body(); Div *div = new Div(); doc->child = body; body->child = div; delete body; if (doc->child) doc->child->getAlign(); Doc *doc *body Body *child *child

7 Preventing Use-after-free with Dangling Pointers Nullification

slide-18
SLIDE 18

Why use-after-free is challenging

Doc *doc = new Doc(); Body *body = new Body(); Div *div = new Div(); doc->child = body; body->child = div; delete body; if (doc->child) doc->child->getAlign(); Body *body = new Body(); Doc *doc = new Doc(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); Doc *doc *body Body *child *child

7 Preventing Use-after-free with Dangling Pointers Nullification

slide-19
SLIDE 19

Why use-after-free is challenging

Doc *doc = new Doc(); Body *body = new Body(); Div *div = new Div(); doc->child = body; body->child = div; delete body; if (doc->child) doc->child->getAlign(); Body *body = new Body(); Doc *doc = new Doc(); doc->child = body; delete body; if (doc->child) doc->child->getAlign(); Doc *doc *body Body *child *child

 Reconstructing object relationships is challenging  Static analysis  Modules are disconnected and scattered  Difficult to serialize execution orders  Dynamic analysis  Tracing pointer semantics is non-trivial

7 Preventing Use-after-free with Dangling Pointers Nullification

slide-20
SLIDE 20

Contributions

  • Present DangNull, which detects use-after-free

– (sometimes) even surviving from use-after-free

  • Stop sophisticated attacks

– Immediately eliminate security impacts of use-after-free

  • Support large-scale software

– Protect popular apps including web browsers

8 Preventing Use-after-free with Dangling Pointers Nullification

slide-21
SLIDE 21

Designs

  • Tracking Object Relationships

– Intercept allocations/deallocations – Instrument pointer propagations

  • Nullify dangling pointers

– A value in dangling pointers has no semantics – Dereferencing nullified pointers will turn into safe-null dereference

9 Preventing Use-after-free with Dangling Pointers Nullification

slide-22
SLIDE 22

Tracking Object Relationships

  • Intercept allocations/deallocations in runtime

– Maintain Shadow Object Tree

  • Red-Black tree to efficiently keep object layout information
  • Node: (base address, size) pair

10 Preventing Use-after-free with Dangling Pointers Nullification

slide-23
SLIDE 23

Tracking Object Relationships

  • Intercept allocations/deallocations in runtime

– Maintain Shadow Object Tree

  • Red-Black tree to efficiently keep object layout information
  • Node: (base address, size) pair

Doc *doc = new Doc();

10 Preventing Use-after-free with Dangling Pointers Nullification

slide-24
SLIDE 24

Tracking Object Relationships

  • Intercept allocations/deallocations in runtime

– Maintain Shadow Object Tree

  • Red-Black tree to efficiently keep object layout information
  • Node: (base address, size) pair

Doc *doc = new Doc();

Insert shadow obj:

  • Base address of allocation
  • Size of Doc

10 Preventing Use-after-free with Dangling Pointers Nullification

slide-25
SLIDE 25

Tracking Object Relationships

  • Intercept allocations/deallocations in runtime

– Maintain Shadow Object Tree

  • Red-Black tree to efficiently keep object layout information
  • Node: (base address, size) pair

delete body; Doc *doc = new Doc();

Insert shadow obj:

  • Base address of allocation
  • Size of Doc

10 Preventing Use-after-free with Dangling Pointers Nullification

slide-26
SLIDE 26

Tracking Object Relationships

  • Intercept allocations/deallocations in runtime

– Maintain Shadow Object Tree

  • Red-Black tree to efficiently keep object layout information
  • Node: (base address, size) pair

delete body; Doc *doc = new Doc();

Insert shadow obj:

  • Base address of allocation
  • Size of Doc

Remove shadow obj:

  • Using base address (body)

10 Preventing Use-after-free with Dangling Pointers Nullification

slide-27
SLIDE 27

Tracking Object Relationships

  • Instrument pointer propagations

– Maintain backward/forward pointer trees for a shadow obj.

doc->child = body;

*doc *body Doc Body *child

11 Preventing Use-after-free with Dangling Pointers Nullification

slide-28
SLIDE 28

Tracking Object Relationships

  • Instrument pointer propagations

– Maintain backward/forward pointer trees for a shadow obj.

doc->child = body; doc->child = body; trace(&doc->child, body);

*doc *body Doc Body *child

11 Preventing Use-after-free with Dangling Pointers Nullification

slide-29
SLIDE 29

Tracking Object Relationships

  • Instrument pointer propagations

– Maintain backward/forward pointer trees for a shadow obj.

Shadow obj. of Doc back fwd back fwd Shadow obj. of Body

doc->child = body; doc->child = body; trace(&doc->child, body);

*doc *body Doc Body *child

11 Preventing Use-after-free with Dangling Pointers Nullification

slide-30
SLIDE 30

Tracking Object Relationships

  • Instrument pointer propagations

– Maintain backward/forward pointer trees for a shadow obj.

Shadow obj. of Doc back fwd back fwd Shadow obj. of Body

doc->child = body; doc->child = body; trace(&doc->child, body);

*doc *body Doc Body *child

Forward

11 Preventing Use-after-free with Dangling Pointers Nullification

slide-31
SLIDE 31

Tracking Object Relationships

  • Instrument pointer propagations

– Maintain backward/forward pointer trees for a shadow obj.

Shadow obj. of Doc back fwd back fwd Shadow obj. of Body

doc->child = body; doc->child = body; trace(&doc->child, body);

*doc *body Doc Body *child

Backward Forward

11 Preventing Use-after-free with Dangling Pointers Nullification

slide-32
SLIDE 32

Tracking Object Relationships

  • Instrument pointer propagations

– Maintain backward/forward pointer trees for a shadow obj.

Shadow obj. of Doc back fwd back fwd Shadow obj. of Body

doc->child = body; doc->child = body; trace(&doc->child, body);

*doc *body Doc Body *child

Backward Forward

11 Preventing Use-after-free with Dangling Pointers Nullification

This is heavily abstracted pointer semantic tracking, but enough to identify all dangling pointers.

slide-33
SLIDE 33

Nullifying Dangling Pointers

  • Nullify all backward pointers of Body, once it is deleted.

– All backward pointers of Body are dangling pointers – Dangling pointers have no semantics – Immediately eliminate dangling pointers

  • Using nullified pointers later will turn into

safe-null dereference.

*doc Freed *body Doc Body *child

12 Preventing Use-after-free with Dangling Pointers Nullification

slide-34
SLIDE 34

Nullifying Dangling Pointers

  • Nullify all backward pointers of Body, once it is deleted.

– All backward pointers of Body are dangling pointers – Dangling pointers have no semantics – Immediately eliminate dangling pointers

  • Using nullified pointers later will turn into

safe-null dereference.

*doc Freed *body Doc Body *child

12 Preventing Use-after-free with Dangling Pointers Nullification

No need to check the pointer validity at the time of use!

slide-35
SLIDE 35

Implementation

  • Prototype DangNull

– Instrumentation: LLVM pass, +389 LoC – Runtime: compiler-rt, +3,955 LoC

  • To build target applications,

– SPEC CPU 2006: one extra compiler and linker flag – Chromium: +27 LoC to .gyp build configuration file

13 Preventing Use-after-free with Dangling Pointers Nullification

slide-36
SLIDE 36

Performance Evaluation

  • Chromium browser

– JavaScript benchmarks

  • 4.8% overheads

– Rendering benchmarks

  • 53.1% overheads

– A page loading time for the Alexa top 100 websites

  • 7% increased load time

Preventing Use-after-free with Dangling Pointers Nullification 14

slide-37
SLIDE 37

Conclusion

  • Presented DangNull, which detects use-after-free in

runtime

  • Applications

– Use-after-free prevention for end-users – Debugging use-after-free vulnerability – Backend new use-after-free vulnerability finding

Preventing Use-after-free with Dangling Pointers Nullification 15

slide-38
SLIDE 38

Demo

16 Preventing Use-after-free with Dangling Pointers Nullification

  • Running Chromium browser (version 29.0.1547.65)

– Hardened using DangNull

  • 140k/16,831k (0.8%) instructions were instrumented

– Testing use-after-free exploit (PoC)

  • CVE-2013-2909: Heap-use-after-free in

WebCore::RenderBlock::determineStartPosition

slide-39
SLIDE 39

Backup slides

17 Preventing Use-after-free with Dangling Pointers Nullification

slide-40
SLIDE 40

Interception / Instrumentation of DangNull

Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; delete body; if (doc->child) doc->child->getAlign();

Use a dangling pointer Free an object Propagate pointers Allocate objects if (doc->child) doc->child->getAlign(); delete body; Doc *doc = new Doc(); Body *body = new Body(); doc->child = body; trace(&doc->child, body);

18 Preventing Use-after-free with Dangling Pointers Nullification

slide-41
SLIDE 41

Use-after-free and dangling pointers

  • Use-after-free != dangling pointer

– Use-after-free happens iif a dangling pointer is used.

  • Dangling pointers

– A pointer points to the freed memory region – No data semantics

  • Benign dangling pointers

– Never dereferenced dangling pointers

  • Unsafe dangling pointers

– Dereferenced dangling pointers

19 Preventing Use-after-free with Dangling Pointers Nullification

slide-42
SLIDE 42

Emerging Threat: Use-after-free

20

Software Vulnerability Exploitation Trends, Microsoft, 2013

slide-43
SLIDE 43

Emerging Threat: Use-after-free

20

Software Vulnerability Exploitation Trends, Microsoft, 2013