BOGO: Buy Spatial Memory Safety, Get Temporal Memory Safety (Almost) Free
BOGO: Buy Spatial Memory Safety, Get Temporal Memory Safety (Almost) Free
复制标题
DOI：
10.1145/3297858.3304017
复制
发表时间：
2019-04
期刊：
影响因子：
--
通讯作者：
T. Zhang;Dongyoon Lee;Changhee Jung
中科院分区：
文献类型：
--
作者：
T. Zhang;Dongyoon Lee;Changhee Jung
当程序具有越界（空间安全）或释放后使用（时间安全）内存访问时，会发生内存安全违规。鉴于其作为安全漏洞的重要性，最近的英特尔处理器支持硬件加速的边界检查，称为内存保护扩展（MPX）。不幸的是，MPX不提供时间安全性。本文提出了BOGO，一个轻量级的全内存安全执行计划，透明地保证MPX的空间安全顶部的时间安全。BOGO没有跟踪单独的元数据以实现时间安全，而是重用MPX维护的边界元数据以实现空间和时间安全。释放时，BOGO扫描MPX绑定表以使悬挂指针的绑定无效;任何随后的释放后使用错误都可以被MPX检测为越界错误。由于扫描整个MPX绑定表的成本可能很高，BOGO跟踪一小部分热MPX绑定表页以进行空闲检查，并依赖于页面错误机制来检测任何潜在的丢失悬挂指针，从而确保可靠的临时安全保护。我们的评估表明，BOGO提供了完整的内存安全在60%的运行时开销和36%的内存开销的SPEC CPU 2006基准。我们还表明，BOGO在最坏情况下的无malloc密集型基准测试中会导致合理的2.7倍减速;对于真实世界的应用程序，开销为1.34倍。
A memory safety violation occurs when a program has an out-of-bound (spatial safety) or use-after-free (temporal safety) memory access. Given its importance as a security vulnerability, recent Intel processors support hardware-accelerated bound checks, called Memory Protection Extensions (MPX). Unfortunately, MPX provides no temporal safety. This paper presents BOGO, a lightweight full memory safety enforcement scheme that transparently guarantees temporal safety on top of MPX's spatial safety. Instead of tracking separate metadata for temporal safety, BOGO reuses the bounds metadata maintained by MPX for both spatial and temporal safety. On free, BOGO scans the MPX bound tables to invalidate the bound of dangling pointers; any following use-after-free error can be detected by MPX as an out-of-bound error. Since scanning the entire MPX bound tables could be expensive, BOGO tracks a small set of hot MPX bound table pages to check on free, and relies on the page fault mechanism to detect any potentially missing dangling pointer, ensuring sound temporal safety protection. Our evaluation shows that BOGO provides full memory safety at 60% runtime overhead and at 36% memory overhead for SPEC CPU 2006 benchmarks. We also show that BOGO incurs reasonable 2.7x slowdown for the worst-case malloc-free intensive benchmarks; and moderate 1.34x overhead for real-world applications.