S2malloc：用于释放后使用（UAF）防护及更多功能的统计安全内存分配器
S2malloc: Statistically Secure Allocator for Use-After-Free Protection And More
AI总结：
提出S2malloc安全内存分配器，通过空闲块金丝雀、块内随机偏移和随机包布局三种机制增强UAF攻击检测，在不增加性能开销的前提下显著提升了防护率。
摘要：
针对堆内存的攻击，包括内存溢出、双重与无效释放、释放后使用（UAF）以及各种堆喷射技术，正日益增多。现有的基于熵的安全内存分配器针对几乎所有这些攻击向量提供了统计防御。尽管它们声称能防御UAF攻击，但其设计并非专门用于检测（失败的）攻击尝试。因此，为了击败这种基于熵的防护，攻击者只需反复发起相同的攻击，并可能利用堆喷射进一步提高成功率。\n我们提出了S2malloc，旨在增强UAF尝试检测，同时不损害其他安全保证或引入显著的性能开销。为此，我们在安全分配器设计中采用了三种创新构造：用于检测UAF尝试的空闲块金丝雀（FBC）、用于阻止攻击者准确覆盖受害对象的块内随机偏移（RIO），以及用于阻碍攻击者根据地址估算块大小的随机包布局（RBL）。\n我们证明：（a）通过为RIO偏移保留25%的对象大小，8字节的金丝雀在针对64字节对象的UAF利用尝试中，若攻击者重用相同指针可提供69%的保护率，若攻击者不重用则提供96%的保护率，且对其他攻击提供同等或更高的安全保证；（b）S2malloc具有实用性，在PARSEC上仅有2.8%的运行时开销，在SPEC上为11.5%。与最先进的基于熵的分配器相比，S2malloc在不产生额外性能开销的前提下提升了UAF防护。与缓解UAF的分配器相比，S2malloc以极小的防护失败概率换取了显著降低的开销。
英文摘要：
Attacks on heap memory, encompassing memory overflow, double and invalid free, use-after-free (UAF), and various heap spraying techniques are ever-increasing. Existing entropy-based secure memory allocators provide statistical defenses against virtually all of these attack vectors. Although they claim protections against UAF attacks, their designs are not tailored to detect (failed) attempts. Consequently, to beat this entropy-based protection, an attacker can simply launch the same attack repeatedly with the potential use of heap spraying to further improve their chance of success. We introduce S2malloc, aiming to enhance UAF-attempt detection without compromising other security guarantees or introducing significant performance overhead. To achieve this, we use three innovative constructs in secure allocator design: free block canaries (FBC) to detect UAF attempts, random in-block offset (RIO) to stop the attacker from accurately overwriting the victim object, and random bag layout (RBL) to impede attackers from estimating the block size based on its address. We show that (a) by reserving 25% of the object size for the RIO offset, an 8-byte canary offers a 69% protection rate if the attacker reuses the same pointer and 96% protection rate if the attacker does not, against UAF exploitation attempts targeting a 64 bytes object, with equal or higher security guarantees against all other attacks; and (b) S2malloc is practical, with only a 2.8% run-time overhead on PARSEC and an 11.5% overhead on SPEC. Compared to state-of-the-art entropy-based allocators, S2malloc improves UAF-protection without incurring additional performance overhead. Compared to UAF-mitigating allocators, S2malloc trades off a minuscule probability of failed protection for significantly lower overhead.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
