Sat 17 Jun 2023 11:20 - 11:45 at Magnolia 18 - SOAP: Session 2 - Dynamic Analysis

C/C++ are often used in high-performance areas with critical security demands, such as operating systems, browsers, and libraries. One major drawback from a security standpoint is their susceptibility to memory bugs, which are often hard to spot during development. A possible solution is the deployment of a memory safety framework such as the memory tagging framework Hardware-assisted AddressSanitizer (HWASan). The dynamic analysis tool instruments object allocations and inserts additional check logic to detect memory violations during runtime. A current limitation of memory tagging is its inability to detect intra-object memory violations i.e., over- and underflows between fields and members of structs and classes. This work addresses the issue by applying the concept of memory shading to memory tagging. We then present HWASanIO, a HWASan-based sanitizer implementing the memory shading concept to detect intra-object violations. Our evaluation shows that this increases the bug detection rate from 85.4% to 100% in the memory corruptions test cases of the Juliet Test Suite while maintaining high interoperability with existing C/C++ code.

Sat 17 Jun

Displayed time zone: Eastern Time (US & Canada) change

11:20 - 12:30
SOAP: Session 2 - Dynamic AnalysisSOAP at Magnolia 18

#soap-sat-magnolia18 Discord icon small YouTube icon small

11:20
25m
Talk
HWASanIO: Detecting C/C++ Intra-object Overflows with Memory Shading
SOAP
Konrad Hohentanner Fraunhofer AISEC, Florian Kasten Fraunhofer AISEC, Lukas Auer Fraunhofer AISEC
DOI
11:45
45m
Keynote
Flux: Refinement types for RustInvited Talk
SOAP
Ranjit Jhala University of California at San Diego