TY - GEN
T1 - SLeak
T2 - 35th Annual Computer Security Applications Conference, ACSAC 2019
AU - Hauser, Christophe
AU - Menon, Jayakrishna
AU - Shoshitaishvili, Yan
AU - Wang, Ruoyu
AU - Vigna, Giovanni
AU - Kruegel, Christopher
N1 - Publisher Copyright:
© 2019 Copyright held by the owner/author(s). Publication rights licensed to ACM.
PY - 2019/12/9
Y1 - 2019/12/9
N2 - We present a novel approach to automatically recover information about the address space layout of remote processes in the presence of Address Space Layout Randomization (ASLR). Our system, dubbed Sleak, performs static analysis and symbolic execution of binary executable programs, and identifies program paths and input parameters leading to partial (i.e., only a few bits) or complete (i.e., the whole address) information disclosure vulnerabilities, revealing addresses of known objects of the target service or application. Sleak takes, as input, the binary executable program, and generates a symbolic expression for each program output that leaks information about the addresses of objects, such as stack variables, heap structures, or function pointers. By comparing these expressions with the concrete output of a remote process executing the same binary program image, our system is able to recover from a few bits to whole addresses of objects of the target application or service. Discovering the address of a single object in the target application is often enough to guess the layout of entire sections of the address space, which can be leveraged by attackers to bypass ASLR.
AB - We present a novel approach to automatically recover information about the address space layout of remote processes in the presence of Address Space Layout Randomization (ASLR). Our system, dubbed Sleak, performs static analysis and symbolic execution of binary executable programs, and identifies program paths and input parameters leading to partial (i.e., only a few bits) or complete (i.e., the whole address) information disclosure vulnerabilities, revealing addresses of known objects of the target service or application. Sleak takes, as input, the binary executable program, and generates a symbolic expression for each program output that leaks information about the addresses of objects, such as stack variables, heap structures, or function pointers. By comparing these expressions with the concrete output of a remote process executing the same binary program image, our system is able to recover from a few bits to whole addresses of objects of the target application or service. Discovering the address of a single object in the target application is often enough to guess the layout of entire sections of the address space, which can be leveraged by attackers to bypass ASLR.
KW - Binary program analysis
KW - Information leakage
KW - Vulnerability discovery
UR - http://www.scopus.com/inward/record.url?scp=85077813449&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85077813449&partnerID=8YFLogxK
U2 - 10.1145/3359789.3359820
DO - 10.1145/3359789.3359820
M3 - Conference contribution
AN - SCOPUS:85077813449
T3 - ACM International Conference Proceeding Series
SP - 190
EP - 202
BT - Proceedings - 35th Annual Computer Security Applications Conference, ACSAC 2019
PB - Association for Computing Machinery
Y2 - 9 December 2019 through 13 December 2019
ER -