HEAPHOPPER: Bringing bounded model CheckingtoHeap implementation security

Moritz Eckert, Antonio Bianchi, Ruoyu Wang, Yan Shoshitaishvili, Christopher Kruegel, Giovanni Vigna

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

Heap metadata attacks have become one of the primary ways in which attackers exploit memory corruption vulnerabilities. While heap implementation developers have introduced miti-gations to prevent and detect corruption, it isstill possible for attackers to work around them. In part, this is because these mitigations are created and evaluated without aprincipled foundation, resulting, in many cases, in complex, inefficient, and ineffective attemptsatheap metadata defenses. In this paper, we present HEAPHOPPER, anautomated approach, basedonmodel checking and symbolic execution, to analyze the exploitability of heap implementations in the presence of memory corruption. Using HEAPHOPPER, we were able to performa systematic analysis of different, widely used heap implementations, finding surprising weak-nessesinthem. Our results show, for instance, howa newly introduced caching mechanismin ptmalloc (the heap allocator implementation usedby most of the Linux distributions) significantly weakens its security. Moreover, HEAPHOPPER guidedus inimplementing and evaluating improvements to the security of ptmalloc, replacing an ineffective recent attempt at the mitigation of a specific form of heap metadata corruption withan effective defense.

Original languageEnglish (US)
Title of host publicationProceedings of the 27th USENIX Security Symposium
PublisherUSENIX Association
Pages99-116
Number of pages18
ISBN (Electronic)9781939133045
StatePublished - Jan 1 2018
Event27th USENIX Security Symposium - Baltimore, United States
Duration: Aug 15 2018Aug 17 2018

Publication series

NameProceedings of the 27th USENIX Security Symposium

Conference

Conference27th USENIX Security Symposium
CountryUnited States
CityBaltimore
Period8/15/188/17/18

Fingerprint

Metadata
Data storage equipment

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Information Systems
  • Safety, Risk, Reliability and Quality

Cite this

Eckert, M., Bianchi, A., Wang, R., Shoshitaishvili, Y., Kruegel, C., & Vigna, G. (2018). HEAPHOPPER: Bringing bounded model CheckingtoHeap implementation security. In Proceedings of the 27th USENIX Security Symposium (pp. 99-116). (Proceedings of the 27th USENIX Security Symposium). USENIX Association.

HEAPHOPPER : Bringing bounded model CheckingtoHeap implementation security. / Eckert, Moritz; Bianchi, Antonio; Wang, Ruoyu; Shoshitaishvili, Yan; Kruegel, Christopher; Vigna, Giovanni.

Proceedings of the 27th USENIX Security Symposium. USENIX Association, 2018. p. 99-116 (Proceedings of the 27th USENIX Security Symposium).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Eckert, M, Bianchi, A, Wang, R, Shoshitaishvili, Y, Kruegel, C & Vigna, G 2018, HEAPHOPPER: Bringing bounded model CheckingtoHeap implementation security. in Proceedings of the 27th USENIX Security Symposium. Proceedings of the 27th USENIX Security Symposium, USENIX Association, pp. 99-116, 27th USENIX Security Symposium, Baltimore, United States, 8/15/18.
Eckert M, Bianchi A, Wang R, Shoshitaishvili Y, Kruegel C, Vigna G. HEAPHOPPER: Bringing bounded model CheckingtoHeap implementation security. In Proceedings of the 27th USENIX Security Symposium. USENIX Association. 2018. p. 99-116. (Proceedings of the 27th USENIX Security Symposium).
Eckert, Moritz ; Bianchi, Antonio ; Wang, Ruoyu ; Shoshitaishvili, Yan ; Kruegel, Christopher ; Vigna, Giovanni. / HEAPHOPPER : Bringing bounded model CheckingtoHeap implementation security. Proceedings of the 27th USENIX Security Symposium. USENIX Association, 2018. pp. 99-116 (Proceedings of the 27th USENIX Security Symposium).
@inproceedings{cb90f0d2a3ca4b4d964fb54d84d73cc2,
title = "HEAPHOPPER: Bringing bounded model CheckingtoHeap implementation security",
abstract = "Heap metadata attacks have become one of the primary ways in which attackers exploit memory corruption vulnerabilities. While heap implementation developers have introduced miti-gations to prevent and detect corruption, it isstill possible for attackers to work around them. In part, this is because these mitigations are created and evaluated without aprincipled foundation, resulting, in many cases, in complex, inefficient, and ineffective attemptsatheap metadata defenses. In this paper, we present HEAPHOPPER, anautomated approach, basedonmodel checking and symbolic execution, to analyze the exploitability of heap implementations in the presence of memory corruption. Using HEAPHOPPER, we were able to performa systematic analysis of different, widely used heap implementations, finding surprising weak-nessesinthem. Our results show, for instance, howa newly introduced caching mechanismin ptmalloc (the heap allocator implementation usedby most of the Linux distributions) significantly weakens its security. Moreover, HEAPHOPPER guidedus inimplementing and evaluating improvements to the security of ptmalloc, replacing an ineffective recent attempt at the mitigation of a specific form of heap metadata corruption withan effective defense.",
author = "Moritz Eckert and Antonio Bianchi and Ruoyu Wang and Yan Shoshitaishvili and Christopher Kruegel and Giovanni Vigna",
year = "2018",
month = "1",
day = "1",
language = "English (US)",
series = "Proceedings of the 27th USENIX Security Symposium",
publisher = "USENIX Association",
pages = "99--116",
booktitle = "Proceedings of the 27th USENIX Security Symposium",

}

TY - GEN

T1 - HEAPHOPPER

T2 - Bringing bounded model CheckingtoHeap implementation security

AU - Eckert, Moritz

AU - Bianchi, Antonio

AU - Wang, Ruoyu

AU - Shoshitaishvili, Yan

AU - Kruegel, Christopher

AU - Vigna, Giovanni

PY - 2018/1/1

Y1 - 2018/1/1

N2 - Heap metadata attacks have become one of the primary ways in which attackers exploit memory corruption vulnerabilities. While heap implementation developers have introduced miti-gations to prevent and detect corruption, it isstill possible for attackers to work around them. In part, this is because these mitigations are created and evaluated without aprincipled foundation, resulting, in many cases, in complex, inefficient, and ineffective attemptsatheap metadata defenses. In this paper, we present HEAPHOPPER, anautomated approach, basedonmodel checking and symbolic execution, to analyze the exploitability of heap implementations in the presence of memory corruption. Using HEAPHOPPER, we were able to performa systematic analysis of different, widely used heap implementations, finding surprising weak-nessesinthem. Our results show, for instance, howa newly introduced caching mechanismin ptmalloc (the heap allocator implementation usedby most of the Linux distributions) significantly weakens its security. Moreover, HEAPHOPPER guidedus inimplementing and evaluating improvements to the security of ptmalloc, replacing an ineffective recent attempt at the mitigation of a specific form of heap metadata corruption withan effective defense.

AB - Heap metadata attacks have become one of the primary ways in which attackers exploit memory corruption vulnerabilities. While heap implementation developers have introduced miti-gations to prevent and detect corruption, it isstill possible for attackers to work around them. In part, this is because these mitigations are created and evaluated without aprincipled foundation, resulting, in many cases, in complex, inefficient, and ineffective attemptsatheap metadata defenses. In this paper, we present HEAPHOPPER, anautomated approach, basedonmodel checking and symbolic execution, to analyze the exploitability of heap implementations in the presence of memory corruption. Using HEAPHOPPER, we were able to performa systematic analysis of different, widely used heap implementations, finding surprising weak-nessesinthem. Our results show, for instance, howa newly introduced caching mechanismin ptmalloc (the heap allocator implementation usedby most of the Linux distributions) significantly weakens its security. Moreover, HEAPHOPPER guidedus inimplementing and evaluating improvements to the security of ptmalloc, replacing an ineffective recent attempt at the mitigation of a specific form of heap metadata corruption withan effective defense.

UR - http://www.scopus.com/inward/record.url?scp=85075955990&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85075955990&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:85075955990

T3 - Proceedings of the 27th USENIX Security Symposium

SP - 99

EP - 116

BT - Proceedings of the 27th USENIX Security Symposium

PB - USENIX Association

ER -