Stopping Memory Disclosures via Diversification and Replicated Execution

Kangjie Lu, Meng Xu, Chengyu Song, Taesoo Kim, Wenke Lee

Research output: Contribution to journalArticlepeer-review

5 Scopus citations

Abstract

With the wide deployment of security mechanisms such as Address Space Layout Randomization (ASLR), memory disclosures have become a prerequisite for critical memory-corruption attacks (e.g., code-reuse attack) - adversaries are forced to exploit memory disclosures to circumvent ASLR as the first step. As a result, the security threats of memory disclosures are now significantly aggravated - they break not only data confidentiality but also the effectiveness of security mechanisms. In this paper, we propose a general detection methodology and develop a system to stop memory disclosures. We observe that memory disclosures are not root causes but rather consequences of a variety of hard-to-detect program errors such as memory corruption and uninitialized read. We thus propose a replicated execution-based methodology to generally detect memory disclosures, regardless of their causes. We realize this methodology with Buddy: By seamlessly maintaining two identical running instances of a target program and diversifying only its target data, Buddy can accurately detects memory disclosures of the data, as doing so will result in the two instances outputting different values. Extensive evaluation results show that Buddy is reliable and efficient while stopping real memory disclosures such as the Heartbleed leak.

Original languageEnglish (US)
Article number8510822
Pages (from-to)160-173
Number of pages14
JournalIEEE Transactions on Dependable and Secure Computing
Volume18
Issue number1
DOIs
StatePublished - Jan 1 2021

Bibliographical note

Publisher Copyright:
© 2020 IEEE.

Keywords

  • Memory disclosure
  • N-version system
  • code-reuse attack
  • diversification
  • replicated execution

Fingerprint Dive into the research topics of 'Stopping Memory Disclosures via Diversification and Replicated Execution'. Together they form a unique fingerprint.

Cite this