Systems and/or methods for automatically protecting against memory corruption vulnerabilities
Certain example embodiments described herein relate to techniques for automatically protecting, or hardening, software against exploits of memory-corruption vulnerabilities. The techniques include arranging a plurality of guard regions in the memory in relation to data objects formed by the application program, identifying an access by the application program to a guard region arranged in the memory as a disallowed access, and modifying the execution of the application program in response to the identifying, the modifying being in order to prevent exploitation of the memory and/or to correctly execute the application program.
1. A security-enhanced computing system, comprising:
processing resources including at least one memory and at least one physical hardware processor coupled thereto, wherein the processing resources are configured to execute a security-enhanced application program by at least:
defining a plurality of guard regions in the memory in relation to data objects formed by the security-enhanced application program;
inserting guards in the guard regions arranged in the memory, wherein the guards are structured to include at least first and second guard values, the guards being inserted in the guard regions and structured to facilitate at least first and second checks, the first check using the first guard value, the second check using the second guard value, the first check being less computationally intensive than the second check, the second check being structured to compensate for a false positive generated by application of the first check, the first and second guard values being different from each other;
determining whether an operation taken by the security-enhanced application program in connection with one of the guard regions arranged in the memory is disallowed by:
identifying an address associated with the operation,
performing the first check in connection with the identified address, the first check generating output indicating that either the operation is allowed or that further scrutiny is needed, and
performing the second check conditioned on the output generated by the first check indicating that further scrutiny is needed, the second check indicating whether the operation is disallowed; and
modifying the execution of the security-enhanced application program in response to a determination that the operation is determined to be disallowed, but otherwise permitting the execution of the security-enhanced application program.
2. The system of claim 1 , wherein the guards are bipartite guards having a predetermined number of bits.
3. The system of claim 1 , wherein the first check includes detecting whether the first guard value is positioned in relation to the identified address.
4. The system of claim 3 , wherein the second check includes detecting whether the second guard value is positioned in relation to the identified address.
5. The system of claim 1 , wherein the second check includes detecting whether the second guard value is positioned in relation to the identified address.
6. The system of claim 1 , wherein the second guard value includes the first guard value repeated a number of times therein.
7. The system of claim 1 , wherein the modification includes generating a runtime exception in connection with the security-enhanced application program.
8. A method for executing a security-enhanced application program on a computing system comprising at least one memory and at least one processor, the method comprising:
defining a plurality of guard regions in the memory in relation to data objects formed by the security-enhanced application program;
inserting guards in each of the guard regions arranged in the memory, wherein the guards are structured to include at least first and second guard values, the guards inserted in each of the guard regions being structured to facilitate at least first and second checks, the first check using the first guard value, the second check using the second guard value, the first check being less computationally intensive than the second check, the second check being structured to compensate for a false positive generated by application of the first check, the first and second guard values being different from each other;
determining whether an operation taken by the security-enhanced application program in connection with one of the guard regions arranged in the memory is disallowed by:
identifying an address associated with the operation,
performing the first check in connection with the identified address, the first check generating output indicating that either the operation is allowed or that further scrutiny is needed, and
performing the second check conditioned on the output generated by the first check indicating that further scrutiny is needed, the second check indicating whether the operation is disallowed; and
modifying the execution of the security-enhanced application program in response to a determination that the operation is determined to be disallowed, but otherwise permitting the execution of the security-enhanced application program.
9. The method of claim 8 , wherein the guards are bipartite guards having a predetermined number of bits.
10. The method of claim 8 , wherein the first check includes detecting whether the first guard value is positioned in relation to the identified address.
11. The method of claim 8 , wherein the second check includes detecting whether the second guard value is positioned in relation to the identified address.
12. The method of claim 8 , wherein the second guard value includes the first guard value repeated a number of times therein.
13. The method of claim 8 , wherein the modification includes generating a runtime exception in connection with the security-enhanced application program.
14. A non-transitory computer readable storage medium storing a security-enhanced application program which, when executed by a processor of a computing system including a memory, causes the computing system to perform operations comprising:
defining a plurality of guard regions in the memory in relation to data objects formed by the security-enhanced application program;
inserting guards in the guard regions arranged in the memory, wherein the guards are structured to include at least first and second guard values, the guards being inserted in the guard regions and structured to facilitate at least first and second checks, the first check using the first guard value, the second check using the second guard value, the first check being less computationally intensive than the second check, the second check being structured to compensate for a false positive generated by application of the first check, the first and second guard values being different from each other;
determining whether an operation taken by the security-enhanced application program in connection with one of the guard regions arranged in the memory is disallowed by:
identifying an address associated with the operation,
performing the first check in connection with the identified address, the first check generating output indicating that either the operation is allowed or that further scrutiny is needed, and
performing the second check conditioned on the output generated by the first check indicating that further scrutiny is needed, the second check indicating whether the operation is disallowed; and
modifying the execution of the security-enhanced application program in response to a determination that the operation is determined to be disallowed, but otherwise permitting the execution of the security-enhanced application program.
15. The non-transitory computer readable storage medium of claim 14 , wherein the guards are bipartite guards having a predetermined number of bits.
16. The non-transitory computer readable storage medium of claim 14 , wherein the first check includes detecting whether the first guard value is positioned in relation to the identified address.
17. The non-transitory computer readable storage medium of claim 16 , wherein the second check includes detecting whether the second guard value is positioned in relation to the identified address.
18. The non-transitory computer readable storage medium of claim 14 , wherein the second check includes detecting whether the second guard value is positioned in relation to the identified address.
19. The non-transitory computer readable storage medium of claim 14 , wherein the second guard value includes the first guard value repeated a number of times therein.
20. The non-transitory computer readable storage medium of claim 14 , wherein the modification includes generating a runtime exception in connection with the security-enhanced application program.