Cornucopia: Temporal Safety for CHERI Heaps-猫眼课题宝

DOI：

10.1109/sp40000.2020.00098

发表时间：

2020-05

期刊：

2020 IEEE Symposium on Security and Privacy (SP)

影响因子：

通讯作者：

中科院分区：

其他

文献类型：

作者：

N. Filardo;B. F. Gutstein;Jonathan Woodruff;S. Ainsworth;Lucian Paul-Trifu;Brooks Davis;Hongyan Xia;E. Napierala;Alexander Richardson;John Baldwin;D. Chisnall;Jessica Clarke;Khilan Gudka;Alexandre Joannou;A. T. Markettos;Alfredo Mazzinghi;Robert M. Norton;M. Roe;Peter Sewell;Stacey D. Son;Timothy M. Jones;S. Moore;P. Neumann;R. Watson

对暂时内存安全的“先使用后使用”的违反继续困扰着软件系统，成为许多高影响漏洞的基础。CHERI能力系统在实现C和c++语言空间内存安全，防止越界访问方面显示出很大的希望。在CHERI上强制执行语言级时态安全需要撤销功能，传统上通过表查找（在CHERI设计中为了性能而避免）或通过识别内存中的功能来撤销它们（类似于垃圾收集器清理）来实现。CHERIvoke先前的可行性研究表明，CHERI的标记功能可以使后一种策略可行，但只模拟了架构限制，而没有考虑该方法的全面实施或评估。Cornucopia是一个用于CHERI的轻量级功能撤销系统，它为标准堆分配实现了非概率C/ c++临时内存安全。它扩展了CheriBSD虚拟内存子系统，以跟踪通过内存的功能流，并提供一个并发的内核驻留撤销服务，该服务适用于多处理器和硬件加速。我们在FPGA上的多核CHERI CPU上的兼容SPEC CPU2006基准测试上演示了并发撤销的平均开销小于2%，最坏情况下为8.9%，并且我们针对Juliet测试套件的临时不安全程序语料验证了Cornucopia。我们通过在引导多用户CheriBSD时使用一个撤销分配器作为系统分配器来测试它与大量C程序的兼容性。Cornucopia是一种可行的策略，用于实现永远在线的临时堆内存安全，适用于生产环境。

Use-after-free violations of temporal memory safety continue to plague software systems, underpinning many high-impact exploits. The CHERI capability system shows great promise in achieving C and C++ language spatial memory safety, preventing out-of-bounds accesses. Enforcing language-level temporal safety on CHERI requires capability revocation, traditionally achieved either via table lookups (avoided for performance in the CHERI design) or by identifying capabilities in memory to revoke them (similar to a garbage-collector sweep). CHERIvoke, a prior feasibility study, suggested that CHERI’s tagged capabilities could make this latter strategy viable, but modeled only architectural limits and did not consider the full implementation or evaluation of the approach.Cornucopia is a lightweight capability revocation system for CHERI that implements non-probabilistic C/C++ temporal memory safety for standard heap allocations. It extends the CheriBSD virtual-memory subsystem to track capability flow through memory and provides a concurrent kernel-resident revocation service that is amenable to multi-processor and hardware acceleration. We demonstrate an average overhead of less than 2% and a worst-case of 8.9% for concurrent revocation on compatible SPEC CPU2006 benchmarks on a multi-core CHERI CPU on FPGA, and we validate Cornucopia against the Juliet test suite’s corpus of temporally unsafe programs. We test its compatibility with a large corpus of C programs by using a revoking allocator as the system allocator while booting multi-user CheriBSD. Cornucopia is a viable strategy for always-on temporal heap memory safety, suitable for production environments.

Cornucopia: Temporal Safety for CHERI Heaps

文献摘要

相似文献