MEBS:Uncovering Memory Life-Cycle Bugs in Operating System Kernels
MEBS:Uncovering Memory Life-Cycle Bugs in Operating System Kernels
复制标题
MEBS：发现操作系统内核中的内存生命周期错误
DOI：
10.1007/s11390-021-1593-4
复制
发表时间：
2021
影响因子：
0.7
通讯作者：
Lu Kai
中科院分区：
文献类型：
--
作者：
Zhang Gen;Wang Pengfei;Yue Tai;Zhou Xu;Lu Kai
在内核中，内存数据的分配、解引用和释放是连贯的。广泛存在内存正确性受到损害的真实的情况。内核内存中的这种不正确性带来了重大的安全问题，例如，内存分配、解引用和释放是一个密切相关的过程，但以往的工作没有认识到它们之间的密切联系，本文研究了内核内存的生命周期，包括内存分配、解引用和释放，本文对内存生命周期（MLC）漏洞进行了深入的研究，并实现了一个内存生命周期漏洞消毒器（MEBS）用于MLC错误检测。MEBS利用过程间全局调用图和新的识别方法，可以揭示内核中的内存分配、解引用和释放位置。通过构造改进的定义-使用链和检查生命周期中的错误，可以识别MLC错误。此外，在最新内核上的实验结果表明，MEBS能够有效地检测MLC漏洞，并且MEBS可以扩展到不同的内核上，在Linux和FreeBSD中发现了100多个新的漏洞，并分配了12个常见的漏洞和暴露（CVE）。
Allocation,dereferencing,and freeing of memory data in kernels are coherently linked.There widely exist real cases where the correctness of memory is compromised.This incorrectness in kernel memory brings about significant security issues,e.g.,information leaking.Though memory allocation,dereferencing,and freeing are closely related,previous work failed to realize they are closely related.In this paper,we study the life-cycle of kernel memory,which consists of allocation,dereferencing,and freeing.Errors in them are called memory life-cycle(MLC)bugs.We propose an in-depth study of MLC bugs and implement a memory life-cycle bug sanitizer(MEBS)for MLC bug detection.Utilizing an interprocedural global call graph and novel identification approaches,MEBS can reveal memory allocation,dereferencing,and freeing sites in kernels.By constructing a modified define-use chain and examining the errors in the life-cycle,MLC bugs can be identified.Moreover,the experimental results on the latest kernels demonstrate that MEBS can effectively detect MLC bugs,and MEBS can be scaled to different kernels.More than 100 new bugs are exposed in Linux and FreeBSD,and 12 common vulnerabilities and exposures(CVE)are assigned.