A Robust and Efficient Defense against Use-after-Free Exploits via Concurrent Pointer Sweeping

TL;DR: A novel defense called pSweeper is presented to robustly protect against UaF exploits with low overhead, and pinpoint the root-causes of UAF vulnerabilities with one safe crash.

Abstract: Applications in C/C++ are notoriously prone to memory corruptions With significant research efforts devoted to this area of study, the security threats posed by previously popular vulnerabilities, such as stack and heap overflows, are not as serious as before Instead, we have seen the meteoric rise of attacks exploiting use-after-free (UaF) vulnerabilities in recent years, which root in pointers pointing to freed memory (ie, dangling pointers) Although various approaches have been proposed to harden software against UaF, none of them can achieve robustness and efficiency at the same time In this paper, we present a novel defense called pSweeper to robustly protect against UaF exploits with low overhead, and pinpoint the root-causes of UaF vulnerabilities with one safe crash The success of pSweeper lies in its two unique and innovative design ideas, concurrent pointer sweeping (CPW) and object origin tracking (OOT) CPW exploits the increasingly available multi-cores on modern PCs and outsources the heavyweight security checks and enforcement to dedicated threads that can run on spare cores Specifically, CPW iteratively sweeps all live pointers in a concurrent thread to find dangling pointers This design is quite different from previous work that requires to track every pointer propagation to maintain accurate point-to relationship between pointers and objects OOT can help to pinpoint the root-causes of UaF by informing developers of how a dangling pointer is created, ie, how the problematic object is allocated and freed We implement a prototype of pSweeper and validate its efficacy in real scenarios Our experimental results show that pSweeper is effective in defeating real-world UaF exploits and efficient when deployed in production runs