SlideShare a Scribd company logo

Effective Memory Protection Using Dynamic Tainting (ASE 2007)

James Clause
James Clause

The document describes an approach for detecting illegal memory accesses using dynamic taint analysis. It assigns taint marks to track data from untrusted sources as it propagates through a program. It propagates taint marks at runtime and checks for illegal accesses when data with taint reaches sensitive program points like memory references. The approach operates at the binary level with minimal modifications, avoiding limitations of prior static and dynamic techniques. It outlines assigning taint marks, propagating them, and checking them to detect illegal accesses with an empirical evaluation and conclusions.

TechnologyHealth & Medicine
1 of 119
Downloaded 34 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
College of Computing Georgia Institute of Technology Supported in part by: NSF awards CCF-0541080 and CCR-0205422 to Georgia Tech, DHS and US Air Force Contract No. FA8750-05-2-0214 Effective Memory Protection Using Dynamic Tainting Ioannis Doudalis Milos Prvulovic (hardware) James Clause Alessandro Orso (software) and
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n:
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n:
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n:
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n:
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 3
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 3
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 3
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 3
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 3 0
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 2
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory i <= n ➜ i < n buf: np: i: n: 9 8 2 3 2
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 2
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 2
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 3 7
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 3 7
void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 3 7 Illegal memory accesses • Caused by common programming mistakes • Cause non-deterministic failures • Cause security vulnerabilities
Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04
Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04 }Require source code
Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04 } } Require source code Unacceptable overhead
Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04 } } Require source code Unacceptable overhead } Extensive modification
Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04 } } Require source code Unacceptable overhead We define our approach to overcome these limitations • Operate at the binary level • Use hardware to reduce overhead • Minimal, practical modifications } Extensive modification
Approach overview
1 Assign taint marks Approach overview
1 Assign taint marks Approach overview P1 A
P1 1 A 1 1 Assign taint marks Approach overview
1 Assign taint marks Approach overview P1 P2 1 2 AB 12
1 Assign taint marks Approach overview P3 P1 P2 3 1 2 AC B 123
1 Assign taint marks Approach overview P3 P1 P2 3 1 2 P5 AC B 123 P4
1 Assign taint marks Approach overview 2 Propagate taint marks P3 P1 P2 3 1 2 P5 AC B 123 P4
1 Assign taint marks Approach overview 2 Propagate taint marks P3 P1 P2 3 1 2 P5 AC B 123 P4
1 Assign taint marks Approach overview 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1
1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1
1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1
1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1
1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1 ✔
1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 AC B 123 P4 P5 3 1
1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 AC B 123 P4 P5 3 1
1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 AC B 123 P4 ✘ P5 3 1
Outline • Our approach 1. Assigning taint marks 2. Propagating taint marks 3. Checking taint marks • Empirical evaluation • Conclusions
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n:
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: { [&np, &np + sizeof(int *))
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n:
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to
Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to address-of operator (&)
Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to
Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321
Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations buf: np: i: n: 4 2 321 3
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations buf: np: i: n: 4 2 321 3 [ret, ret + arg0) {
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations buf: np: i: n: 4 2 321 3
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations buf: np: i: n: 4 2 321555 3
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory return value of malloc
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory buf: np: i: n: 4 2 321555 3
Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview P1 1 P2
AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview +, −, ×, ÷, and, or, xor, ... P1 1 P2
AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview +, −, ×, ÷, and, or, xor, ... P1 1 P2 Should the result be tainted? If so, how?
AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview • Propagation must take into account both operation semantics and programmer intent +, −, ×, ÷, and, or, xor, ... P1 1 P2 Should the result be tainted? If so, how?
AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview • Propagation must take into account both operation semantics and programmer intent • Our policy is based on knowledge of C/C++/assembly and patterns observed in real software +, −, ×, ÷, and, or, xor, ... P1 1 P2 Should the result be tainted? If so, how?
AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Addition, Subtraction A +/− B = C A B C Most common use of addition and subtraction is to add or subtract a pointer and an offset 1 1 1 /1 no taint ...
AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR AND The result of anding a pointer and a mask should be treated differently depending on the value of the mask c = a & 0xffffff00 - base address c = a & 0x000000ff - offset A & B = C A B C 1 or1 no taint ...
AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Multiplication, Division, OR, XOR We found zero cases where the result of any of these operations was a pointer
Checking taint marks When memory is accessed through a pointer: compare the memory taint mark and the pointer taint mark 3 Pointer Memory IMA? no yes yes yes yes 1 2 2 2 3 3
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... }
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... }
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... }
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4321
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4321
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321 ✔
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321 3
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321 3
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 3
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 3
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 3 0
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } + =5 5 buf: np: 5 i: n: 4 2321555 3 0
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } + =5 5 buf: np: 5 i: n: 4 2321555 3 0 ✔
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 3 0
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 3 0
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 8 2 3 2
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 8 2 3 2
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 8 2 3 3 + =5 5
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 8 2 3 3 + =5 5 ✘
Limiting the number of taint marks An unlimited number of taint marks makes a hardware implementation infeasible • increases the overhead (time and space) • complicates the design
Limiting the number of taint marks An unlimited number of taint marks makes a hardware implementation infeasible • increases the overhead (time and space) • complicates the design ➡ Assign taint marks from a limited, reusable pool
Effects on the approach With an random assignment of n taint marks the detection probability is: IMAs are detected probabilistically p = 1 1 n
Effects on the approach With an random assignment of n taint marks the detection probability is: IMAs are detected probabilistically 2 marks = 50%, 4 marks = 75%, 16 marks = 93.75%, 256 marks = 99.6% p = 1 1 n
Effects on the approach With an random assignment of n taint marks the detection probability is: 1. The technique can be tuned by increasing or decreasing the number of taint marks IMAs are detected probabilistically 2 marks = 50%, 4 marks = 75%, 16 marks = 93.75%, 256 marks = 99.6% p = 1 1 n
Effects on the approach With an random assignment of n taint marks the detection probability is: 1. The technique can be tuned by increasing or decreasing the number of taint marks 2. In practice the approach is successful with only a small number (2) of taint marks IMAs are detected probabilistically 2 marks = 50%, 4 marks = 75%, 16 marks = 93.75%, 256 marks = 99.6% p = 1 1 n
Empirical evaluation RQ1: Is the efficiency of our approach sufficient for it to be applied to deployed software? RQ2:What is the effectiveness of our technique when using limited number of taint marks?
RQ1: experimental method • Hardware implementation • Cycle accurate simuator (SESC) • Treat taint marks as first class citizens • Subjects • SPEC CPU2000 benchmark (12 applications) • Calculate the overhead imposed by our approach for each subject application
RQ1: experimental method • Hardware implementation • Cycle accurate simuator (SESC) • Treat taint marks as first class citizens • Subjects • SPEC CPU2000 benchmark (12 applications) • Calculate the overhead imposed by our approach for each subject application Current implementation assigns taint marks only to dynamically allocated memory, but propagation and checking are fully implemented
RQ1: results 0 5 10 15 20 25 30 bzip2 crafty eon gap gcc gzip m cf parser perlbm k twolf vortex vpr average %overhead(time) 2 marks 8 marks 16 marks 256 marks
RQ1: results 0 5 10 15 20 25 30 bzip2 crafty eon gap gcc gzip m cf parser perlbm k twolf vortex vpr average %overhead(time) 2 marks 8 marks 16 marks 256 marks • Even with 256 marks, the average overhead is in the single digits
RQ1: results 0 5 10 15 20 25 30 bzip2 crafty eon gap gcc gzip m cf parser perlbm k twolf vortex vpr average %overhead(time) 2 marks 8 marks 16 marks 256 marks • All attacks were detected with two taint marks • Even with 256 marks, the average overhead is in the single digits
RQ1: results 0 5 10 15 20 25 30 bzip2 crafty eon gap gcc gzip m cf parser perlbm k twolf vortex vpr average %overhead(time) 2 marks 8 marks 16 marks 256 marks • All attacks were detected with two taint marks • Software-only implementations impose two orders of magnitude more overhead • Even with 256 marks, the average overhead is in the single digits
RQ2: experimental method • Software implementation • Binary instrumenter (Pin) • Use instrumentation to assign, propagate, and check taint marks • Subjects • SPEC CPU2000 benchmark (12 applications) • 5 applications with 7 known IMAs • Run both each applications protected by our software implementation and check that only the known illegal memory accesses are detected (5 times)
RQ2: results Application IMA location Type Detected bc-1.06 more_arrays: 177 buffer overflow ✔ (5/5) bc-1.06 lookup: 577 buffer overflow ✔ (5/5) gnupg-1.4.4 parse_comment: 2095 integer overflow ✔ (5/5) mutt-1.4.2.li utf8_to_utf7: 199 buffer overflow ✔ (5/5) php-5.2.0 php_char_to_str_ex: 3152 integer overflow ✔ (5/5) pine-4.44 rfc882_cat: 260 buffer overflow ✔ (5/5) squid-2.3 ftpBuildTitleUrl: 1024 buffer overflow ✔ (5/5) Applications with known IMAs
RQ2: results Application IMA location Type Detected bc-1.06 more_arrays: 177 buffer overflow ✔ (5/5) bc-1.06 lookup: 577 buffer overflow ✔ (5/5) gnupg-1.4.4 parse_comment: 2095 integer overflow ✔ (5/5) mutt-1.4.2.li utf8_to_utf7: 199 buffer overflow ✔ (5/5) php-5.2.0 php_char_to_str_ex: 3152 integer overflow ✔ (5/5) pine-4.44 rfc882_cat: 260 buffer overflow ✔ (5/5) squid-2.3 ftpBuildTitleUrl: 1024 buffer overflow ✔ (5/5) Applications with known IMAs All attacks were detected with two taint marks
RQ2: results Application IMA location Type Detected bc-1.06 more_arrays: 177 buffer overflow ✔ (5/5) bc-1.06 lookup: 577 buffer overflow ✔ (5/5) gnupg-1.4.4 parse_comment: 2095 integer overflow ✔ (5/5) mutt-1.4.2.li utf8_to_utf7: 199 buffer overflow ✔ (5/5) php-5.2.0 php_char_to_str_ex: 3152 integer overflow ✔ (5/5) pine-4.44 rfc882_cat: 260 buffer overflow ✔ (5/5) squid-2.3 ftpBuildTitleUrl: 1024 buffer overflow ✔ (5/5) Application IMA location Type Detected vortex SendMsg: 279 null-pointer dereference ✔ (5/5) Applications with known IMAs SPEC Benchmarks (“IMA free”) All attacks were detected with two taint marks
Future work • Complete implementation that handles static memory • Additional experiments with a wider range of IMAs • Further optimization of the hardware implementation
Conclusions • Definition of an approach for preventing illegal memory accesses in deployed software • uses dynamic taint analysis to protect memory • uses probabilistic detection to achieve acceptable overhead • Empirical evaluation showing that the approach • is effective at detecting IMA in real applications • can be implemented efficiently in hardware

More Related Content

Similar to Effective Memory Protection Using Dynamic Tainting (ASE 2007) (20)

PDF
Appsec obfuscator reloaded
Cyber Security Alliance
 
PDF
Dmitriy D1g1 Evdokimov - DBI Intro
DefconRussia
 
PDF
Константин Серебряный "Быстрый динамичекский анализ программ на примере поиск...
Yandex
 
PDF
Fast dynamic analysis, Kostya Serebryany
yaevents
 
PPTX
Evgeniy Muralev, Mark Vince, Working with the compiler, not against it
Sergey Platonov
 
PDF
150104 3 methods for-binary_analysis_and_valgrind
Raghu Palakodety
 
PPT
Detecting and Preventing Memory Attacks#
gwarloki1
 
PDF
A guided fuzzing approach for security testing of network protocol software
binish_hyunseok
 
PDF
Beyond Breakpoints: A Tour of Dynamic Analysis
Fastly
 
PDF
Introduction to Compiler Development
Logan Chien
 
PDF
Parallel Computing - Lec 4
Shah Zaib
 
PDF
Cray XT Porting, Scaling, and Optimization Best Practices
Jeff Larkin
 
PDF
Speedup Your Java Apps with Hardware Counters
C4Media
 
PDF
May2010 hex-core-opt
Jeff Larkin
 
PDF
Memory Management Strategies - I.pdf
Harika Pudugosula
 
PPT
Unit 2 Principles of Programming Languages
Vasavi College of Engg
 
PPT
Georgy Nosenko - An introduction to the use SMT solvers for software security
DefconRussia
 
PDF
OptimizingARM
Jan-Lieuwe Koopmans
 
PPTX
A scrupulous code review - 15 bugs in C++ code
PVS-Studio LLC
 
PDF
Auto Tuning
Hemanth Kumar Mantri
 
Appsec obfuscator reloaded
Cyber Security Alliance
 
Dmitriy D1g1 Evdokimov - DBI Intro
DefconRussia
 
Константин Серебряный "Быстрый динамичекский анализ программ на примере поиск...
Yandex
 
Fast dynamic analysis, Kostya Serebryany
yaevents
 
Evgeniy Muralev, Mark Vince, Working with the compiler, not against it
Sergey Platonov
 
150104 3 methods for-binary_analysis_and_valgrind
Raghu Palakodety
 
Detecting and Preventing Memory Attacks#
gwarloki1
 
A guided fuzzing approach for security testing of network protocol software
binish_hyunseok
 
Beyond Breakpoints: A Tour of Dynamic Analysis
Fastly
 
Introduction to Compiler Development
Logan Chien
 
Parallel Computing - Lec 4
Shah Zaib
 
Cray XT Porting, Scaling, and Optimization Best Practices
Jeff Larkin
 
Speedup Your Java Apps with Hardware Counters
C4Media
 
May2010 hex-core-opt
Jeff Larkin
 
Memory Management Strategies - I.pdf
Harika Pudugosula
 
Unit 2 Principles of Programming Languages
Vasavi College of Engg
 
Georgy Nosenko - An introduction to the use SMT solvers for software security
DefconRussia
 
OptimizingARM
Jan-Lieuwe Koopmans
 
A scrupulous code review - 15 bugs in C++ code
PVS-Studio LLC
 
Auto Tuning
Hemanth Kumar Mantri
 

More from James Clause (12)

PDF
Investigating the Impacts of Web Servers on Web Application Energy Usage (GRE...
James Clause
 
PDF
Energy-directed Test Suite Optimization (GREENS 2013)
James Clause
 
PDF
Enabling and Supporting the Debugging of Field Failures (Job Talk)
James Clause
 
PDF
Debugging Field Failures by Minimizing Captured Executions (ICSE 2009: NIER e...
James Clause
 
PDF
A Technique for Enabling and Supporting Debugging of Field Failures (ICSE 2007)
James Clause
 
PDF
Demand-Driven Structural Testing with Dynamic Instrumentation (ICSE 2005)
James Clause
 
PDF
Initial Explorations on Design Pattern Energy Usage (GREENS 12)
James Clause
 
PDF
Enabling and Supporting the Debugging of Software Failures (PhD Defense)
James Clause
 
PDF
Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)
James Clause
 
PDF
Penumbra: Automatically Identifying Failure-Relevant Inputs (ISSTA 2009)
James Clause
 
PDF
Dytan: A Generic Dynamic Taint Analysis Framework (ISSTA 2007)
James Clause
 
PDF
Camouflage: Automated Anonymization of Field Data (ICSE 2011)
James Clause
 
Investigating the Impacts of Web Servers on Web Application Energy Usage (GRE...
James Clause
 
Energy-directed Test Suite Optimization (GREENS 2013)
James Clause
 
Enabling and Supporting the Debugging of Field Failures (Job Talk)
James Clause
 
Debugging Field Failures by Minimizing Captured Executions (ICSE 2009: NIER e...
James Clause
 
A Technique for Enabling and Supporting Debugging of Field Failures (ICSE 2007)
James Clause
 
Demand-Driven Structural Testing with Dynamic Instrumentation (ICSE 2005)
James Clause
 
Initial Explorations on Design Pattern Energy Usage (GREENS 12)
James Clause
 
Enabling and Supporting the Debugging of Software Failures (PhD Defense)
James Clause
 
Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)
James Clause
 
Penumbra: Automatically Identifying Failure-Relevant Inputs (ISSTA 2009)
James Clause
 
Dytan: A Generic Dynamic Taint Analysis Framework (ISSTA 2007)
James Clause
 
Camouflage: Automated Anonymization of Field Data (ICSE 2011)
James Clause
 
Ad

Recently uploaded (20)

PDF
Fl Studio 24.2.2 Build 4597 Crack for Windows Free Download 2025
faizk77g
 
PPTX
UiPath Academic Alliance Educator Panels: Session 2 - Business Analyst Content
DianaGray10
 
PPTX
Q2 FY26 Tableau User Group Leader Quarterly Call
lward7
 
PDF
"AI Transformation: Directions and Challenges", Pavlo Shaternik
Fwdays
 
PDF
How Startups Are Growing Faster with App Developers in Australia.pdf
India App Developer
 
PDF
HCIP-Data Center Facility Deployment V2.0 Training Material (Without Remarks ...
mcastillo49
 
PDF
New from BookNet Canada for 2025: BNC BiblioShare - Tech Forum 2025
BookNet Canada
 
PDF
Blockchain Transactions Explained For Everyone
CIFDAQ
 
PPTX
Webinar: Introduction to LF Energy EVerest
DanBrown980551
 
PDF
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
PDF
DevBcn - Building 10x Organizations Using Modern Productivity Metrics
Justin Reock
 
PDF
CIFDAQ Token Spotlight for 9th July 2025
CIFDAQ
 
PPTX
AUTOMATION AND ROBOTICS IN PHARMA INDUSTRY.pptx
sameeraaabegumm
 
PDF
Python basic programing language for automation
DanialHabibi2
 
PDF
Newgen Beyond Frankenstein_Build vs Buy_Digital_version.pdf
darshakparmar
 
PDF
LLMs.txt: Easily Control How AI Crawls Your Site
Keploy
 
PDF
July Patch Tuesday
Ivanti
 
PDF
NewMind AI - Journal 100 Insights After The 100th Issue
NewMind AI
 
PDF
Reverse Engineering of Security Products: Developing an Advanced Microsoft De...
nwbxhhcyjv
 
PDF
HubSpot Main Hub: A Unified Growth Platform
Jaswinder Singh
 
Fl Studio 24.2.2 Build 4597 Crack for Windows Free Download 2025
faizk77g
 
UiPath Academic Alliance Educator Panels: Session 2 - Business Analyst Content
DianaGray10
 
Q2 FY26 Tableau User Group Leader Quarterly Call
lward7
 
"AI Transformation: Directions and Challenges", Pavlo Shaternik
Fwdays
 
How Startups Are Growing Faster with App Developers in Australia.pdf
India App Developer
 
HCIP-Data Center Facility Deployment V2.0 Training Material (Without Remarks ...
mcastillo49
 
New from BookNet Canada for 2025: BNC BiblioShare - Tech Forum 2025
BookNet Canada
 
Blockchain Transactions Explained For Everyone
CIFDAQ
 
Webinar: Introduction to LF Energy EVerest
DanBrown980551
 
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
DevBcn - Building 10x Organizations Using Modern Productivity Metrics
Justin Reock
 
CIFDAQ Token Spotlight for 9th July 2025
CIFDAQ
 
AUTOMATION AND ROBOTICS IN PHARMA INDUSTRY.pptx
sameeraaabegumm
 
Python basic programing language for automation
DanialHabibi2
 
Newgen Beyond Frankenstein_Build vs Buy_Digital_version.pdf
darshakparmar
 
LLMs.txt: Easily Control How AI Crawls Your Site
Keploy
 
July Patch Tuesday
Ivanti
 
NewMind AI - Journal 100 Insights After The 100th Issue
NewMind AI
 
Reverse Engineering of Security Products: Developing an Advanced Microsoft De...
nwbxhhcyjv
 
HubSpot Main Hub: A Unified Growth Platform
Jaswinder Singh
 
Ad

Effective Memory Protection Using Dynamic Tainting (ASE 2007)

  • 1. College of Computing Georgia Institute of Technology Supported in part by: NSF awards CCF-0541080 and CCR-0205422 to Georgia Tech, DHS and US Air Force Contract No. FA8750-05-2-0214 Effective Memory Protection Using Dynamic Tainting Ioannis Doudalis Milos Prvulovic (hardware) James Clause Alessandro Orso (software) and
  • 2. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory
  • 3. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory
  • 4. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory
  • 5. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n:
  • 6. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n:
  • 7. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n:
  • 8. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n:
  • 9. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 3
  • 10. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 3
  • 11. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 3
  • 12. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 3
  • 13. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 3 0
  • 14. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 2
  • 15. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory i <= n ➜ i < n buf: np: i: n: 9 8 2 3 2
  • 16. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 2
  • 17. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 2
  • 18. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 3 7
  • 19. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 3 7
  • 20. void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } Illegal memory accesses (IMA) Memory buf: np: i: n: 9 8 2 3 3 7 Illegal memory accesses • Caused by common programming mistakes • Cause non-deterministic failures • Cause security vulnerabilities
  • 21. Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04
  • 22. Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04 }Require source code
  • 23. Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04 } } Require source code Unacceptable overhead
  • 24. Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04 } } Require source code Unacceptable overhead } Extensive modification
  • 25. Previous work Static techniques •Language based e.g., Jim et al. 02, Necula et al. 05 •Analysis based e.g., Dor et al. 03, Hallem et al. 02, Heine and Lam 03, Xie et al. 03 Dynamic techniques •Analysis based e.g., Dhurjati and Adve 06, Ruwase and Lam 04, Xu et al. 04, Hastings and Joyce 92, Seward and Nethercote 05 •Hardware based e.g., Qin et al. 05,Venkataramani et al. 07, Crandall and Chong 04, Dalton et al. 07,Vachharajani et al. 04 } } Require source code Unacceptable overhead We define our approach to overcome these limitations • Operate at the binary level • Use hardware to reduce overhead • Minimal, practical modifications } Extensive modification
  • 30. 1 Assign taint marks Approach overview P1 P2 1 2 AB 12
  • 31. 1 Assign taint marks Approach overview P3 P1 P2 3 1 2 AC B 123
  • 32. 1 Assign taint marks Approach overview P3 P1 P2 3 1 2 P5 AC B 123 P4
  • 33. 1 Assign taint marks Approach overview 2 Propagate taint marks P3 P1 P2 3 1 2 P5 AC B 123 P4
  • 34. 1 Assign taint marks Approach overview 2 Propagate taint marks P3 P1 P2 3 1 2 P5 AC B 123 P4
  • 35. 1 Assign taint marks Approach overview 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1
  • 36. 1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1
  • 37. 1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1
  • 38. 1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1
  • 39. 1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 P5 3 AC B 123 P4 1 ✔
  • 40. 1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 AC B 123 P4 P5 3 1
  • 41. 1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 AC B 123 P4 P5 3 1
  • 42. 1 Assign taint marks Approach overview 3 Check taint marks 2 Propagate taint marks P3 P1 P2 3 1 2 AC B 123 P4 ✘ P5 3 1
  • 43. Outline • Our approach 1. Assigning taint marks 2. Propagating taint marks 3. Checking taint marks • Empirical evaluation • Conclusions
  • 44. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
  • 45. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range
  • 46. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n:
  • 47. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: { [&np, &np + sizeof(int *))
  • 48. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n:
  • 49. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321
  • 50. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
  • 51. Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to
  • 52. Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to address-of operator (&)
  • 53. Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to
  • 54. Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321
  • 55. Memory Pointers 1 Assigning taint marksStaticDynamic buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to
  • 56. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
  • 57. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations
  • 58. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations buf: np: i: n: 4 2 321 3
  • 59. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations buf: np: i: n: 4 2 321 3 [ret, ret + arg0) {
  • 60. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations buf: np: i: n: 4 2 321 3
  • 61. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations buf: np: i: n: 4 2 321555 3
  • 62. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
  • 63. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
  • 64. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory return value of malloc
  • 65. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
  • 66. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory buf: np: i: n: 4 2 321555 3
  • 67. Memory Pointers 1 Assigning taint marksStaticDynamic 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
  • 68. Memory Pointers 1 Assigning taint marksStaticDynamic void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Static memory allocations 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4321 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to statically allocated memory 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to 1 Identify the ranges of allocated memory 2 Assign a unique taint mark to each range buf: np: i: n: 4 2 321 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Dynamic memory allocations 1 Identify pointer creation sites 2 Assign the pointer the same taint mark as the memory it points to buf: np: i: n: 4 2 321555 3 void main() { int *np, n, i, *buf; np = &n; printf(“Enter size: “); scanf(“%d”, np); buf = malloc(n * sizeof(int)); for(i = 0; i <= n; i++) *(buf + i) = rand()%10; ... } Pointers to dynamically allocated memory
  • 69. AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview P1 1 P2
  • 70. AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview +, −, ×, ÷, and, or, xor, ... P1 1 P2
  • 71. AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview +, −, ×, ÷, and, or, xor, ... P1 1 P2 Should the result be tainted? If so, how?
  • 72. AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview • Propagation must take into account both operation semantics and programmer intent +, −, ×, ÷, and, or, xor, ... P1 1 P2 Should the result be tainted? If so, how?
  • 73. AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Overview • Propagation must take into account both operation semantics and programmer intent • Our policy is based on knowledge of C/C++/assembly and patterns observed in real software +, −, ×, ÷, and, or, xor, ... P1 1 P2 Should the result be tainted? If so, how?
  • 74. AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Addition, Subtraction A +/− B = C A B C Most common use of addition and subtraction is to add or subtract a pointer and an offset 1 1 1 /1 no taint ...
  • 75. AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR AND The result of anding a pointer and a mask should be treated differently depending on the value of the mask c = a & 0xffffff00 - base address c = a & 0x000000ff - offset A & B = C A B C 1 or1 no taint ...
  • 76. AND Addition, Subtraction Overview Propagating taint marks2 Multiplication, Division, OR, XOR Multiplication, Division, OR, XOR We found zero cases where the result of any of these operations was a pointer
  • 77. Checking taint marks When memory is accessed through a pointer: compare the memory taint mark and the pointer taint mark 3 Pointer Memory IMA? no yes yes yes yes 1 2 2 2 3 3
  • 78. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... }
  • 79. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... }
  • 80. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... }
  • 81. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4321
  • 82. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4321
  • 83. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321
  • 84. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321
  • 85. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321
  • 86. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321 ✔
  • 87. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321
  • 88. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321 3
  • 89. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: i: n: 4 2321 3
  • 90. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 3
  • 91. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 3
  • 92. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 3 0
  • 93. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } + =5 5 buf: np: 5 i: n: 4 2321555 3 0
  • 94. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } + =5 5 buf: np: 5 i: n: 4 2321555 3 0 ✔
  • 95. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 3 0
  • 96. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 3 0
  • 97. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 8 2 3 2
  • 98. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 8 2 3 2
  • 99. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 8 2 3 3 + =5 5
  • 100. Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... } buf: np: 5 i: n: 4 2321555 9 8 2 3 3 + =5 5 ✘
  • 101. Limiting the number of taint marks An unlimited number of taint marks makes a hardware implementation infeasible • increases the overhead (time and space) • complicates the design
  • 102. Limiting the number of taint marks An unlimited number of taint marks makes a hardware implementation infeasible • increases the overhead (time and space) • complicates the design ➡ Assign taint marks from a limited, reusable pool
  • 103. Effects on the approach With an random assignment of n taint marks the detection probability is: IMAs are detected probabilistically p = 1 1 n
  • 104. Effects on the approach With an random assignment of n taint marks the detection probability is: IMAs are detected probabilistically 2 marks = 50%, 4 marks = 75%, 16 marks = 93.75%, 256 marks = 99.6% p = 1 1 n
  • 105. Effects on the approach With an random assignment of n taint marks the detection probability is: 1. The technique can be tuned by increasing or decreasing the number of taint marks IMAs are detected probabilistically 2 marks = 50%, 4 marks = 75%, 16 marks = 93.75%, 256 marks = 99.6% p = 1 1 n
  • 106. Effects on the approach With an random assignment of n taint marks the detection probability is: 1. The technique can be tuned by increasing or decreasing the number of taint marks 2. In practice the approach is successful with only a small number (2) of taint marks IMAs are detected probabilistically 2 marks = 50%, 4 marks = 75%, 16 marks = 93.75%, 256 marks = 99.6% p = 1 1 n
  • 107. Empirical evaluation RQ1: Is the efficiency of our approach sufficient for it to be applied to deployed software? RQ2:What is the effectiveness of our technique when using limited number of taint marks?
  • 108. RQ1: experimental method • Hardware implementation • Cycle accurate simuator (SESC) • Treat taint marks as first class citizens • Subjects • SPEC CPU2000 benchmark (12 applications) • Calculate the overhead imposed by our approach for each subject application
  • 109. RQ1: experimental method • Hardware implementation • Cycle accurate simuator (SESC) • Treat taint marks as first class citizens • Subjects • SPEC CPU2000 benchmark (12 applications) • Calculate the overhead imposed by our approach for each subject application Current implementation assigns taint marks only to dynamically allocated memory, but propagation and checking are fully implemented
  • 111. RQ1: results 0 5 10 15 20 25 30 bzip2 crafty eon gap gcc gzip m cf parser perlbm k twolf vortex vpr average %overhead(time) 2 marks 8 marks 16 marks 256 marks • Even with 256 marks, the average overhead is in the single digits
  • 112. RQ1: results 0 5 10 15 20 25 30 bzip2 crafty eon gap gcc gzip m cf parser perlbm k twolf vortex vpr average %overhead(time) 2 marks 8 marks 16 marks 256 marks • All attacks were detected with two taint marks • Even with 256 marks, the average overhead is in the single digits
  • 113. RQ1: results 0 5 10 15 20 25 30 bzip2 crafty eon gap gcc gzip m cf parser perlbm k twolf vortex vpr average %overhead(time) 2 marks 8 marks 16 marks 256 marks • All attacks were detected with two taint marks • Software-only implementations impose two orders of magnitude more overhead • Even with 256 marks, the average overhead is in the single digits
  • 114. RQ2: experimental method • Software implementation • Binary instrumenter (Pin) • Use instrumentation to assign, propagate, and check taint marks • Subjects • SPEC CPU2000 benchmark (12 applications) • 5 applications with 7 known IMAs • Run both each applications protected by our software implementation and check that only the known illegal memory accesses are detected (5 times)
  • 115. RQ2: results Application IMA location Type Detected bc-1.06 more_arrays: 177 buffer overflow ✔ (5/5) bc-1.06 lookup: 577 buffer overflow ✔ (5/5) gnupg-1.4.4 parse_comment: 2095 integer overflow ✔ (5/5) mutt-1.4.2.li utf8_to_utf7: 199 buffer overflow ✔ (5/5) php-5.2.0 php_char_to_str_ex: 3152 integer overflow ✔ (5/5) pine-4.44 rfc882_cat: 260 buffer overflow ✔ (5/5) squid-2.3 ftpBuildTitleUrl: 1024 buffer overflow ✔ (5/5) Applications with known IMAs
  • 116. RQ2: results Application IMA location Type Detected bc-1.06 more_arrays: 177 buffer overflow ✔ (5/5) bc-1.06 lookup: 577 buffer overflow ✔ (5/5) gnupg-1.4.4 parse_comment: 2095 integer overflow ✔ (5/5) mutt-1.4.2.li utf8_to_utf7: 199 buffer overflow ✔ (5/5) php-5.2.0 php_char_to_str_ex: 3152 integer overflow ✔ (5/5) pine-4.44 rfc882_cat: 260 buffer overflow ✔ (5/5) squid-2.3 ftpBuildTitleUrl: 1024 buffer overflow ✔ (5/5) Applications with known IMAs All attacks were detected with two taint marks
  • 117. RQ2: results Application IMA location Type Detected bc-1.06 more_arrays: 177 buffer overflow ✔ (5/5) bc-1.06 lookup: 577 buffer overflow ✔ (5/5) gnupg-1.4.4 parse_comment: 2095 integer overflow ✔ (5/5) mutt-1.4.2.li utf8_to_utf7: 199 buffer overflow ✔ (5/5) php-5.2.0 php_char_to_str_ex: 3152 integer overflow ✔ (5/5) pine-4.44 rfc882_cat: 260 buffer overflow ✔ (5/5) squid-2.3 ftpBuildTitleUrl: 1024 buffer overflow ✔ (5/5) Application IMA location Type Detected vortex SendMsg: 279 null-pointer dereference ✔ (5/5) Applications with known IMAs SPEC Benchmarks (“IMA free”) All attacks were detected with two taint marks
  • 118. Future work • Complete implementation that handles static memory • Additional experiments with a wider range of IMAs • Further optimization of the hardware implementation
  • 119. Conclusions • Definition of an approach for preventing illegal memory accesses in deployed software • uses dynamic taint analysis to protect memory • uses probabilistic detection to achieve acceptable overhead • Empirical evaluation showing that the approach • is effective at detecting IMA in real applications • can be implemented efficiently in hardware