DangKiller：利用隐式标识符有效消除悬空指针
DangKiller: Eliminating Dangling Pointers Efficiently via Implicit Identifier
摘要：
释放后释放漏洞允许攻击者通过悬挂指针访问非预期内存，更具威胁性。然而，大多数检测方案只能检测悬空指针并使其无效，而不能提供容错机制来在运行时修复错误。此外，这些技术获得和管理元数据效率低下，结构复杂，扫描（扫描）太多。本文的目标是使用编译器插装来自动有效地消除悬空指针。在本文中，我们观察到，大多数技术缺乏准确有效的指针图元数据维护方法，所以他们需要扫描日志，以减少冗余和扫描整个地址空间，以找到悬空指针。此外，他们缺乏一个直接的，有效地获得元数据的方法。本文的主要观点是，唯一标识符可以用作散列或直接映射算法的密钥。因此，本文对每个记忆对象及其对应的引用对象保持相同的隐式标识符。将唯一ID与存储器对象的元数据相关联，可以有效地获得和管理指针图元数据。因此，随着延迟释放技术被引入C/C++，我们提出了DangKiller作为一个新的和轻量级的悬挂指针消除解决方案。我们首先演示了MinFat Pointer，它可以快速计算每个对象和指针的唯一隐式ID，并使用哈希算法获得元数据。其次，我们提出了基于ID的日志缓存和日志压缩机制，以减少候选悬空指针的冗余。结合ARM 64系统上的地址标记架构，我们的实验表明，除了特殊情况外，DangKiller可以分别以SPEC CPU 2006和2017基准测试的11%和3%的运行时开销消除释放后使用漏洞。
英文摘要：
Use-After-Free vulnerabilities, allowing the attacker to access unintended memory via dangling pointers, are more threatening. However, most detection schemes can only detect dangling pointers and invalid them, but not provide a tolerance mechanism to repair the errors at runtime. Also, these techniques obtain and manage the metadata inefficiently with complex structures and too much scan (sweep). The goal of this paper is to use compiler instrumentation to eliminate dangling pointers automatically and efficiently. In this paper, we observe that most techniques lack accurate efficient pointer graph metadata maintaining methods, so they need to scan the log to reduce the redundancy and sweep the whole address space to find dangling pointers. Also, they lack a direct, efficiently obtaining metadata approach. The key insight of this paper is that a unique identifier can be used as a key to a hash or direct-map algorithm. Thus, this paper maintains the same implicit identifier with each memory object and its corresponding referent. Associating the unique ID with metadata for memory objects, obtaining and managing the pointer graph metadata can be efficiently. Therefore, with the delayed free technique adopted into C/C++, we present the DangKiller as a novel and lightweight dangling pointer elimination solution. We first demonstrate the MinFat Pointer, which can calculate unique implicit ID for each object and pointer quickly, and use hash algorithm to obtain metadata. Secondly, we propose the Log Cache and Log Compression mechanism based on the ID to decrease the redundancy of dangling pointer candidates. Coupled with the Address Tagging architecture on an ARM64 system, our experiments show that the DangKiller can eliminate use-after-free vulnerabilities at only 11% and 3% runtime overheads for the SPEC CPU2006 and 2017 benchmarks respectively, except for unique cases.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
