HWASanIO: Detecting C/C++ Intra-object Overflows with Memory Shading
C/C++ are often used in high-performance areas with critical security demands, such as operating systems, browsers, and libraries. One major drawback from a security standpoint is their susceptibility to memory bugs, which are often hard to spot during development. A possible solution is the deployment of a memory safety framework such as the memory tagging framework Hardware-assisted AddressSanitizer (HWASan). The dynamic analysis tool instruments object allocations and inserts additional check logic to detect memory violations during runtime. A current limitation of memory tagging is its inability to detect intra-object memory violations i.e., over- and underflows between fields and members of structs and classes. This work addresses the issue by applying the concept of memory shading to memory tagging. We then present HWASanIO, a HWASan-based sanitizer implementing the memory shading concept to detect intra-object violations. Our evaluation shows that this increases the bug detection rate from 85.4% to 100% in the memory corruptions test cases of the Juliet Test Suite while maintaining high interoperability with existing C/C++ code.
Sat 17 JunDisplayed time zone: Eastern Time (US & Canada) change
11:20 - 12:30 | |||
11:20 25mTalk | HWASanIO: Detecting C/C++ Intra-object Overflows with Memory Shading SOAP DOI | ||
11:45 45mKeynote | Flux: Refinement types for RustInvited Talk SOAP Ranjit Jhala University of California at San Diego |