CSOD: Context-Sensitive Overflow Detection
CSOD: Context-Sensitive Overflow Detection
复制标题
DOI：
10.1109/cgo.2019.8661198
复制
发表时间：
2019-02
期刊：
影响因子：
--
通讯作者：
Hongyu Liu;Sam Silvestro;Xiaoyin Wang;Lide Duan;Tongping Liu
中科院分区：
文献类型：
--
作者：
Hongyu Liu;Sam Silvestro;Xiaoyin Wang;Lide Duan;Tongping Liu
缓冲区溢出可能是最常见的内存问题。它可能导致不稳定的程序行为，如不正确的输出和崩溃，并可被利用来发起安全攻击。近三十年来，检测缓冲区溢出引起了大量的研究关注。然而，由于缓冲区溢出导致的安全攻击的盛行，表明现有工具在生产环境中仍然没有得到广泛的利用，可能是因为它们的性能开销较高，或者是因为它们的有效性有限。CSOD提出了一种新颖的上下文敏感溢出检测技术，该技术可以根据不同分配调用上下文的行为动态调整其检测策略，使其能够通过四个硬件观察点有效地检测数百万对象中的溢出。它可以正确地报告缓冲区过度写入和过度读取的根本原因，而不需要任何额外的手动工作。此外，CSOD平均只带来6.7%的性能开销，这使得它作为生产软件的一种始终在线的方法很有吸引力。
Buffer overflow is possibly the most well-known memory issue. It can cause erratic program behavior, such as incorrect outputs and crashes, and can be exploited to issue security attacks. Detecting buffer overflows has drawn significant research attention for almost three decades. However, the prevalence of security attacks due to buffer overflows indicates that existing tools are still not widely utilized in production environments, possibly due to their high performance overhead or limited effectiveness.This paper proposes CSOD, a buffer overflow detection tool designed for the production environment. CSOD proposes a novel context-sensitive overflow detection technique that can dynamically adjust its detection strategy based on the behavior of different allocation calling contexts, enabling it to effectively detect overflows in millions of objects via four hardware watchpoints. It can correctly report root causes of buffer over-writes and over-reads, without any additional manual effort. Furthermore, CSOD only introduces 6.7% performance overhead on average, which makes it appealing as an always-on approach for production software.