Effective Memory Protection Using Dynamic Tainting James Clause - PowerPoint PPT Presentation
Effective Memory Protection Using Dynamic Tainting James Clause Ioanis Doudalis and Alessandro Orso Milos Prvulovic (software) (hardware) College of Computing Georgia Institute of Technology Supported in part by: NSF awards CCF-0541080
Approach overview 3 2 1 C B A 1 Assign taint marks P 1 2 Propagate P 4 taint marks 1 1 P 2 2 3 Check P 5 taint marks P 3 3 3
Approach overview 3 2 1 C B A 1 Assign taint marks P 1 2 Propagate P 4 taint marks 1 1 P 2 2 3 Check P 5 taint marks P 3 3 3
Approach overview 3 2 1 C B A 1 Assign taint marks � P 1 2 Propagate P 4 taint marks 1 1 P 2 2 3 Check P 5 taint marks P 3 3 3
Approach overview 3 2 1 C B A 1 Assign taint marks P 1 2 Propagate P 4 taint marks 1 1 P 2 2 3 Check P 5 taint marks P 3 3 3
Approach overview 3 2 1 C B A 1 Assign taint marks P 1 2 Propagate P 4 taint marks 1 1 P 2 2 3 Check P 5 taint marks P 3 3 3
Approach overview 3 2 1 C B A 1 Assign taint marks P 1 � 2 Propagate P 4 taint marks 1 1 P 2 2 3 Check P 5 taint marks P 3 3 3
Outline • Our approach 1. Assigning taint marks 2. Propagating taint marks 3. Checking taint marks • Empirical evaluation • Conclusions
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic buf: i: n: Memory Pointers np:
1 Assigning taint marks Static [&np , &np + sizeof(int *)) Dynamic buf: i: n: { Memory Pointers np:
1 Assigning taint marks Static Dynamic buf: i: n: Memory Pointers np:
1 Assigning taint marks Static Dynamic buf: 4 i: 3 n: 2 Memory Pointers np: 1
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static address-of operator ( &) Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic buf: 4 i: 3 n: 2 Memory Pointers np: 1
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic buf: 4 i: 3 n: 3 2 Memory Pointers np: 1 2
1 Assigning taint marks { Static Dynamic [ret, ret + arg0) buf: 4 i: 3 n: 3 2 Memory Pointers np: 1 2
1 Assigning taint marks Static Dynamic buf: 4 i: 3 n: 3 2 Memory Pointers np: 1 2
1 Assigning taint marks Static 5 5 5 Dynamic buf: 4 i: 3 n: 3 2 Memory Pointers np: 1 2
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic return value of malloc Memory Pointers
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static 5 5 5 Dynamic buf: 4 i: 3 n: 3 2 Memory Pointers np: 1 2
1 Assigning taint marks Static Dynamic Memory Pointers
1 Assigning taint marks Static Dynamic Memory Pointers
Propagating taint marks 2 Overview Overview P 1 P 2 Addition, Subtraction 1 AND Multiplication, Division, OR, XOR
Propagating taint marks 2 + , � , � , ÷ , Overview Overview P 1 P 2 and , or , xor , Addition, Subtraction 1 ... AND Multiplication, Division, OR, XOR
Propagating taint marks 2 + , � , � , ÷ , Overview Overview P 1 P 2 and , or , xor , Addition, Subtraction 1 ... Should the result be tainted? AND If so, how? Multiplication, Division, OR, XOR
Propagating taint marks 2 + , � , � , ÷ , Overview Overview P 1 P 2 and , or , xor , Addition, Subtraction 1 ... Should the result be tainted? AND If so, how? Multiplication, Division, • Propagation must take into account both OR, XOR operation semantics and programmer intent
Propagating taint marks 2 + , � , � , ÷ , Overview Overview P 1 P 2 and , or , xor , Addition, Subtraction 1 ... Should the result be tainted? AND If so, how? Multiplication, Division, • Propagation must take into account both OR, XOR operation semantics and programmer intent • Our policy is based on knowledge of C/C++/assembly and patterns observed in real software
Propagating taint marks 2 A + / − B = C Overview A B C 1 1 Addition, Subtraction Addition, Subtraction / no 1 1 taint ... AND Most common use of addition and Multiplication, Division, subtraction is to add or subtract a OR, XOR pointer and an offset
Propagating taint marks 2 A & B = C Overview A B C no or 1 1 taint Addition, Subtraction ... AND AND The result of and ing a pointer and a mask should be treated differently depending on the value of the mask Multiplication, Division, OR, XOR c = a & 0xffffff00 - base address c = a & 0x000000ff - offset
Propagating taint marks 2 Overview Addition, Subtraction We found zero cases where the AND result of any of these operations was a pointer Multiplication, Division, Multiplication, Division, OR, XOR OR, XOR
Checking taint marks 3 When memory is accessed through a pointer: compare the memory taint mark and the pointer taint mark Pointer Memory IMA? no 2 2 yes 1 2 yes 3 yes 3 yes
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... }
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... }
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5. buf = malloc(n * sizeof(int)); 6. for(i = 0; i <= n; i++) 7. *(buf + i) = rand()%10; ... }
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: ... 2 } np: 1
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: ... 2 } np: 1
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: ... 2 } np: 1 2
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: ... 2 } np: 1 2
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: ... 2 } np: 1 2
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: ... 2 } np: 1 2 �
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: ... 2 } np: 1 2
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: 1 2
Preventing IMAs void main() { 1. int *np, n, i, *buf; 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: 1 2
Preventing IMAs 5 void main() { 1. int *np, n, i, *buf; 5 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: 1 2
Preventing IMAs 5 void main() { 1. int *np, n, i, *buf; 5 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: 1 2
Preventing IMAs 5 void main() { 1. int *np, n, i, *buf; 5 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 0 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: 1 2
Preventing IMAs 5 void main() { 1. int *np, n, i, *buf; 5 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 0 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: + = 5 5 1 2
Preventing IMAs 5 void main() { 1. int *np, n, i, *buf; 5 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 � i: 0 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: + = 5 5 1 2
Preventing IMAs 5 void main() { 1. int *np, n, i, *buf; 5 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 0 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: 1 2
Preventing IMAs 9 5 void main() { 1. int *np, n, i, *buf; 5 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 0 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: 1 2
Preventing IMAs 9 5 void main() { 8 1. int *np, n, i, *buf; 5 2 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 2 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: 1 2
Preventing IMAs 9 5 void main() { 8 1. int *np, n, i, *buf; 5 2 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 2 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: 1 2
Preventing IMAs 9 5 void main() { 8 1. int *np, n, i, *buf; 5 2 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 3 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: + = 5 5 1 2
Preventing IMAs 9 5 void main() { 8 1. int *np, n, i, *buf; 5 2 5 2. np = &n; 3. printf(“Enter size: “); 4. scanf(“%d”, np); 5 buf: 5. buf = malloc(n * sizeof(int)); 4 i: 3 � 6. for(i = 0; i <= n; i++) 3 7. *(buf + i) = rand()%10; n: 3 ... 2 } np: + = 5 5 1 2
Recommend
More recommend
Explore More Topics
Stay informed with curated content and fresh updates.