TWC: Small: Caging Libraries To Control Software Faults

大多数应用程序中的绝大多数代码来自它导入的库，而不是程序本身。因此，黑客经常利用跨多个应用程序使用的库（如glibc或openssl）中的缺陷，而不是攻击特定于应用程序的代码中的单个缺陷。这使得攻击者更容易利用一个漏洞同时危害许多应用程序。这项工作将已部署程序中缺陷的影响隔离到尽可能小的区域。这将极大地提高云、移动电话以及两者之间所有应用程序的安全性。为了实现这一目标，本研究开发了一种新的抽象，作为一种轻量级且极其高效的进程内隔离机制，该机制基于操作系统虚拟化和内存安全代码执行（如SFI）的最新进展。这种抽象称为笼，它允许在同一进程中执行的不同代码片段彼此隔离。这意味着一段代码中的缺陷只能被用来利用这个笼子里的代码。从资源会计的角度来看，每个笼子在概念上也是它自己的过程。此外，笼子之间的调用非常轻量级，不需要上下文切换或操作系统干预。笼抽象提供了一种高性能且开销极低的隔离机制，同时提高了应用程序的安全性。

The vast majority of the code in most applications comes from the libraries it imports, rather than the program itself. As a result, hackers often exploit flaws in libraries like glibc or openssl that are used across multiple applications instead of attacking individual flaws in code specific to the application. This makes it easier for an attacker to compromise many applications at once with a single exploit. This work isolates the impact of flaws in a deployed program into the smallest area possible. This will dramatically increase the security of applications in the cloud, on mobile phones, and everything in between.To achieve this goal, this research develops a new abstraction that acts as a lightweight and extremely efficient intra-process isolation mechanism that builds on recent advances from operating system virtualization and memory-safe code execution (such as SFI). This abstraction, called a cage, allows different pieces of code that execute in the same process to be isolated from each other. This means that a flaw within a piece of code can only be used to exploit the code within that cage. Each cage also conceptually is its own process from an resource accounting standpoint. In addition, calls between cages are extremely lightweight and do not require a context switch or OS intervention. The cage abstraction provides an isolation mechanism that is high-performance and with very low overhead while improving application security.