Watchdoglite: Hardware-accelerated compiler-based pointer checking

Proceedings of the 12th ACM/IEEE International Symposium on Code Generation and Optimization, CGO 2014

Volumn , Issue , 2014, Pages 175-184

  Nagarakatte, Santosh ^a   Martin, Milo M K ^b   Zdancewic, Steve ^b  

^a RUTGERS UNIVERSITY   (United States)

^b UNIVERSITY OF PENNSYLVANIA   (United States)

Author keywords

Bounds checking; Memory safety; Spatial safety; Temporal safety; Use after free checking

Indexed keywords

HARDWARE; METADATA;

BOUNDS CHECKING; COMPILER IMPLEMENTATION; HARDWARE ACCELERATION; HARDWARE-ACCELERATED; MEMORY SAFETY; SECURITY VULNERABILITIES; TEMPORAL SAFETY; USE-AFTER-FREE CHECKING;

PROGRAM COMPILERS;

EID: 84900675340     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2544137.2544147     Document Type: Conference Paper

References (48)

1. P. Akritidis, M. Costa, M. Castro, and S. Hand. Baggy Bounds Checking: An Efficient and Backwards-Compatible Defense Against Out-of-Bounds Errors. In Proceedings of the 18th USENIX Security Symposium, Aug. 2009.
2. T. M. Austin, S. E. Breach, and G. S. Sohi. Efficient Detection of All Pointer and Array Access Errors. In Proceedings of the SIGPLAN 1994 Conference on Programming Language Design and Implementation, June 1994.
3. E. G. Barrantes, D. H. Ackley, T. S. Palmer, D. Stefanovic, and D. D. Zovi. Randomized Instruction Set Emulation to Disrupt Binary Code Inject Attacks. In Proceedings of the 10th ACM Conference on Computer and Communications Security, 2003.
4. E. D. Berger and B. G. Zorn. Die Hard: Probabilistic Memory Safety for Unsafe Languages. In Proceedings of the SIGPLAN 2006 Conference on Programming Language Design and Implementation, June 2006.
5. S. Bhatkar and R. Sekar. Data Space Randomization. In Proceedings of the 5th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, 2008.
6. R. Bodik, R. Gupta, and V. Sarkar. ABCD: Eliminating Array Bounds Checks on Demand. In Proceedings of the SIGPLAN 2000 Conference on Programming Language Design and Implementation, June 2000.
7. S. Bradshaw. Heap Spray Exploit Tutorial: Internet Explorer Use After Free Aurora Vulnerability. http://www.thegreycorner.com/2010/01/heap-spray- exploit-tutorial-internet.html.
8. M. Castro, M. Costa, and T. Harris. Securing Software by Enforcing Data-Flow Integrity. In Proceedings of the 7th USENIX Symposium on Operating Systems Design and Implementation, Nov. 2006.
9. S. Chen, M. Kozuch, T. Strigkos, B. Falsafi, P. B. Gibbons, T. C. Mowry, V. Ramachandran, O. Ruwase, M. Ryan, and E. Vlachos. Flexible Hardware Acceleration for Instruction-Grain Program Monitoring. In Proceedings of the 35th Annual International Symposium on Computer Architecture, June 2008.
10. W. Chuang, S. Narayanasamy, and B. Calder. Accelerating Meta Data Checks for Software Correctness and Security. Journal of Instruction- Level Parallelism, 9, June 2007.
11. J. Condit, M. Harren, Z. Anderson, D. Gay, and G. C. Necula. Dependent Types for Low-Level Programming. In Proceedings of the 16th European Symposium on Programming, Apr. 2007.
12. J. Devietti, C. Blundell, M. M. K. Martin, and S. Zdancewic. Hardbound: Architectural Support for Spatial Safety of the C Programming Language. In Proceedings of the 13th International Conference on Architectural Support for Programming Languages and Operating Systems, Mar. 2008.
13. D. Dhurjati and V. Adve. Backwards-Compatible Array Bounds Checking for C with Very Low Overhead. In Proceedings of the 28th International Conference on Software Engineering (ICSE), 2006.
14. F. C. Eigler. Mudflap: Pointer Use Checking for C/C++. In GCC Developer's Summit, 2003.
15. K. Ganesh. Pointer Checker: Easily Catch Out-of-Bounds Memory Accesses. Intel Corporation, 2012. http://software.intel.com/sites/products/parallelmag/ singlearticles/issue11/7080-2-IN-ParallelMag-Issue11-Pointer-Checker.pdf.
16. S. Ghose, L. Gilgeous, P. Dudnik, A. Aggarwal, and C. Waxman. Architectural Support for Low Overhead Detection of Memory Viloations. In Proceedings of the Design, Automation and Test in Europe, Mar. 2009.
17. A. Hilton and A. Roth. Decoupled Store Completion/Silent Deterministic Replay: Enabling Scalable Data Memory for CPR/CFP Processors. In Proceedings of the 37th Annual International Symposium on Computer Architecture, June 2010.
18. A. D. Hilton, S. Nagarakatte, and A. Roth. iCFP: Tolerating All- Level Cache Misses in In-Order Processors. In Proceedings of the 15th Symposium on High-Performance Computer Architecture, Feb. 2009.
19. Intel Corporation. Intel Architecture Instruction Set Extensions Programming Reference, 319433-015 edition, July 2013. http://download-software. intel.com/sites/default/files/319433-015.pdf.
20. R. W. M. Jones and P. H. J. Kelly. Backwards-Compatible Bounds Checking for Arrays and Pointers in C Programs. In Third International Workshop on Automated Debugging, Nov. 1997.
21. G. S. Kc, A. D. Keromytis, and V. Prevelakis. Countering Code- Injection Attacks With Instruction-Set Randomization. In Proceedings of the 10th ACM Conference on Computer and Communications Security, 2003.
22. M. Kharbutli, X. Jiang, Y. Solihin, G. Venkataramani, and M. Prvulovic. Comprehensively and Efficiently Protecting the Heap. In Proceedings of the 12th International Conference on Architectural Support for Programming Languages and Operating Systems, Oct. 2006.
23. V. Markstein, J. Cocke, and P. Markstein. Optimization of Range Checking. In Proceedings of the 1982 SIGPLAN symposium on Compiler Construction, 1982.
24. S. Nagarakatte. Practical Low-Overhead Enforcement of Memory Safety for C Programs. PhD thesis, University of Pennsylvania, 2012.
25. S. Nagarakatte, M. M. K. Martin, and S. Zdancewic. Watchdog: Hardware for Safe and Secure Manual Memory Management and Full Memory Safety. In Proceedings of the 39th Annual International Symposium on Computer Architecture, June 2012.
26. S. Nagarakatte, M. M. K. Martin, and S. Zdancewic. Hardware- Enforced Comprehensive Memory Safety. IEEE Micro, 33(3), May/June 2013.
27. S. Nagarakatte, J. Zhao, M. M. K. Martin, and S. Zdancewic. Soft- Bound: Highly Compatible and Complete Spatial Memory Safety for C. In Proceedings of the SIGPLAN 2009 Conference on Programming Language Design and Implementation, June 2009.
28. S. Nagarakatte, J. Zhao, M. M. K. Martin, and S. Zdancewic. CETS: Compiler Enforced Temporal Safety for C. In Proceedings of the 2010 International Symposium on Memory Management, June 2010.
29. G. C. Necula, J. Condit, M. Harren, S. McPeak, and W. Weimer. CCured: Type-Safe Retrofitting of Legacy Software. ACM Transactionstions on Programming Languages and Systems, 27(3), May 2005.
30. N. Nethercote and J. Seward. How to Shadow Every Byte of Memory Used by a Program. In Proceedings of the 3rd ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments, 2007.
31. N. Nethercote and J. Seward. Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation. In Proceedings of the SIGPLAN 2007 Conference on Programming Language Design and Implementation, June 2007.
32. NIST. NIST Juliet Test Suite for C/C++, 2010. http://samate.nist.gov/SRD/ .
33. G. Novark and E. D. Berger. DieHarder: Securing the Heap. In Proceedings of the 17th ACM Conference on Computer and Communications Security, 2010.
34. G. Novark, E. D. Berger, and B. G. Zorn. Exterminator: Automatically Correcting Memory Errors with High Probability. In Proceedings of the SIGPLAN 2007 Conference on Programming Language Design and Implementation, June 2007.
35. B. V. Patel, R. Gopalakrishna, A. F. Glew, R. J. Kushlis, D. A. V. Dyke, J. F. Cihula, A. K. Mallick, J. B. Crossland, G. Nelger, S. D. Rodgers, M. G. Dixon, M. J. Charney, and J. Gottelieb. Managing and Implementing Metadata in Central Processing Unit Using Register Extensions, Mar. 2011. US Patent Pub No: US 2011/0078389 A1.
36. H. Patil and C. N. Fischer. Low-Cost, Concurrent Checking of Pointer and Array Accesses in C Programs. Software - Practice & Experience, 27(1):87-110, 1997.
37. J. Pincus and B. Baker. Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns. IEEE Security & Privacy, 2(4):20-27, 2004.
38. P. Porras, H. Saidi, and V. Yegneswaran. An Analysis of Conficker's Logic and Rendezvous Points. Technical report, SRI International, Feb. 2009.
39. F. Qin, S. Lu, and Y. Zhou. SafeMem: Exploiting ECC-Memory for Detecting Memory Leaks and Memory Corruption During Production Runs. In Proceedings of the 11th Symposium on High-Performance Computer Architecture, Feb. 2005.
40. K. Serebryany, D. Bruening, A. Potapenko, and D. Vyukov. Address Sanitizer: A Fast Address Sanity Checker. In Proceedings of the USENIX Annual Technical Conference, 2012.
41. J. Seward and N. Nethercote. Using Valgrind to Detect Undefined Value Errors with Bit-Precision. In Proceedings of the 2005 USENIX Annual Technical Conference, Apr. 2005.
42. M. S. Simpson and R. K. Barua. MemSafe: Ensuring the Spatial and Temporal Memory Safety of C at Runtime. In IEEE International Workshop on Source Code Analysis and Manipulation, 2010.
43. L. Szekeres, M. Payer, T. Wei, and D. Song. SoK: Eternal War in Memory. In Proceedings of the 2013 IEEE Symposium on Security and Privacy, 2013.
44. G. Venkataramani, B. Roemer, M. Prvulovic, and Y. Solihin. Mem- Tracker: Efficient and Programmable Support for Memory Access Monitoring and Debugging. In Proceedings of the 13th Symposium on High-Performance Computer Architecture, Feb. 2007.
45. J. Wilander and M. Kamkar. A Comparison of Publicly Available Tools for Dynamic Buffer Overflow Prevention. In Proceedings of the Network and Distributed Systems Security Symposium, 2003.
46. R. E. Wunderlich, T. F. Wenisch, B. Falsafi, and J. C. Hoe. SMARTS: Accelerating Microarchitecture Simulation via Rigorous Statistical Sampling. In Proceedings of the 30th Annual International Symposium on Computer Architecture, June 2003.
47. W. Xu, D. C. DuVarney, and R. Sekar. An Efficient and Backwards- Compatible Transformation to Ensure Memory Safety of C Programs. In Proceedings of the 12th ACM SIGSOFT International Symposium on Foundations of Software Engineering, 2004.
48. J. Zhao, S. Nagarakatte, M. M. K. Martin, and S. Zdancewic. Formalizing the LLVM Intermediate Representation for Verified Program Transformations. In Proceedings of The 39th ACM SIGPLAN/SIGACT Symposium on Principles of Programming Languages, Jan. 2012.