Hypervisor-based buffer overflow detection and prevention
View Patent ↗Technologies for securing an electronic device include determining addresses of one or more memory pages, injecting for each memory page a portion of identifier data into the memory page, storing an indication of the identifier data injected into each of the memory pages, determining an attempt to access at least one of the memory pages, determining any of the identifier data present on a memory page associated with the attempt, comparing the indication of the identifier data with the determined identifier data present on the memory page, and, based on the comparison, determining whether to allow the access.
1. A method for securing an electronic device, comprising:
determining a memory page to be monitored;
determining portions of the memory page allocated for content for applications;
marking all remaining portions of the memory page as unallocated for content for applications and unwriteable other than by authorized functions of an operating system;
determining, at a level below the operating system, an attempt from the level of the operating system, the attempt to access unallocated portions of the memory page marked as unwriteable other than by authorized functions of the operating system;
determining whether the attempt originated from an authorized function of the operating system; and
in response to a determination that the attempt did not originate from an authorized function of the operating system, blocking the attempt,
wherein the remaining portions of the memory page include a size indicator of an allocation, the size indicator having been written to an unallocated portion of the memory page by an authorized function of the operating system,
wherein determining whether the attempt originated from an authorized function of the operating system includes determining whether the attempt originated from a deallocation function of the operating system,
wherein the portions of the memory page marked as unallocated for content for applications and unwriteable other than by authorized functions of the operating system include one or more portions of the memory between memory allocations.
2. The method of claim 1 , wherein the remaining portions of the memory page include unused memory spaces.
3. The method of claim 1 , wherein determining whether the attempt originated from an authorized function of the operating system includes determining whether the attempt originated from an allocation function of the operating system.
4. At least one non-transitory machine readable storage medium, comprising computer-executable instructions carried on the machine readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
determine a memory page to be monitored;
determine portions of the memory page allocated for content for applications;
mark all remaining portions of the memory page as unallocated for content for applications and unwriteable other than by authorized functions of an operating system;
determine, at a level below the operating system, an attempt from the level of the operating system, the attempt to access unallocated portions of the memory page marked as unwriteable other than by authorized functions of the operating system;
determine whether the attempt originated from an authorized function of the operating system; and
in response to a determination that the attempt did not originate from an authorized function of the operating system, block the attempt,
wherein the remaining portions of the memory page include a size indicator of an allocation, the size indicator having been written to an unallocated portion of the memory page by an authorized function of the operating system,
wherein determining whether the attempt originated from an authorized function of the operating system includes determining whether the attempt originated from a deallocation function of the operating system,
wherein the portions of the memory page marked as unallocated for content for applications and unwriteable other than by authorized functions of the operating system include one or more portions of the memory between memory allocations.
5. The medium of claim 4 , wherein the remaining portions of the memory page include unused memory spaces.
6. The medium of claim 4 , wherein determining whether the attempt originated from an authorized function of the operating system includes determining whether the attempt originated from an allocation function of the operating system.
7. A system for securing an electronic device, comprising:
a processor;
at least one non-transitory machine readable storage medium communicatively coupled to the processor and comprising computer-executable instructions carried on the machine readable medium, the instructions readable by the processor, the instructions, when read and executed, for causing the processor to:
determine a memory page to be monitored;
determine portions of the memory page allocated for content for applications;
mark all remaining portions of the memory page as unallocated for content for applications and unwriteable other than by authorized functions of an operating system;
determine, at a level below the operating system, an attempt from the level of the operating system, the attempt to write to unallocated portions of the memory page marked as unwriteable other than by authorized functions of the operating system;
determine whether the attempt originated from an authorized function of the operating system; and
in response to a determination that the attempt did not originate from an authorized function of the operating system, block the attempt,
wherein the remaining portions of the memory page include a size indicator of an allocation, the size indicator having been written to an unallocated portion of the memory page by an authorized function of the operating system,
wherein determining whether the attempt originated from an authorized function of the operating system includes determining whether the attempt originated from a deallocation function of the operating system,
wherein the portions of the memory page marked as unallocated for content for applications and unwriteable other than by authorized functions of the operating system include one or more portions of the memory between memory allocations.
8. The system of claim 7 , wherein the remaining portions of the memory page include unused memory spaces.
9. The system of claim 7 , wherein determining whether the attempt originated from an authorized function of the operating system includes determining whether the attempt originated from an allocation function of the operating system.