UAFSan: An Object-Identifier-Based Dynamic Approach for Detecting Use-After-Free Vulnerabilities
Sat 17 Jul 2021 09:50 - 10:10 at ISSTA 2 - Session 28 (time band 3) Fuzzing and Runtime Analysis Chair(s): Michaël Marcozzi
Use-After-Free (UAF) vulnerabilities constitute severe threats to software security. In contrast to other memory errors, UAFs are more difficult to detect through manual or static analysis due to pointer aliases and complicated relationships between pointers and objects. Existing evidence-based dynamic detection approaches only track either pointers or objects to record the availability of objects, which become invalid when the memory that stored the freed object is reallocated. To this end, we propose an approach \textsf{UAFSan} dedicated to comprehensively detecting UAFs at runtime. Specifically, we assign a unique identifier to each newly-allocated object and its pointers; when a pointer dereferences a memory object, we determine whether a UAF occurs by checking the consistency of their identifiers. We implement \textsf{UAFSan} in an open-source tool and evaluate it on a large collection of popular benchmarks and real-world programs. The experiment results demonstrate that \textsf{UAFSan} successfully detect all UAFs with reasonable overhead, whereas existing publicly-available dynamic detectors all miss certain UAFs.
Presentation(pdf) (issta_pre_final.pdf) | 2.22MiB |
Thu 15 JulDisplayed time zone: Brussels, Copenhagen, Madrid, Paris change
01:40 - 02:20 | Session 8 (time band 2) Dynamic AnalysisTechnical Papers at ISSTA 2 Chair(s): Luís Pina University of Illinois at Chicago | ||
01:40 20mTalk | Runtime Detection of Memory Errors with Smart Status Technical Papers Zhe Chen Nanjing University of Aeronautics and Astronautics, Chong Wang Nanjing University of Aeronautics and Astronautics, Junqi Yan Nanjing University of Aeronautics and Astronautics, Yulei Sui University of Technology Sydney, Jingling Xue UNSW DOI Media Attached | ||
02:00 20mTalk | UAFSan: An Object-Identifier-Based Dynamic Approach for Detecting Use-After-Free Vulnerabilities Technical Papers Binfa Gui Nanjing University of Science and Technology, Wei Song Nanjing University of Science and Technology, Jeff Huang Texas A&M University DOI Media Attached File Attached |
Sat 17 JulDisplayed time zone: Brussels, Copenhagen, Madrid, Paris change
09:30 - 10:50 | Session 28 (time band 3) Fuzzing and Runtime AnalysisTechnical Papers at ISSTA 2 Chair(s): Michaël Marcozzi Université Paris-Saclay, CEA, List | ||
09:30 20mTalk | Runtime Detection of Memory Errors with Smart Status Technical Papers Zhe Chen Nanjing University of Aeronautics and Astronautics, Chong Wang Nanjing University of Aeronautics and Astronautics, Junqi Yan Nanjing University of Aeronautics and Astronautics, Yulei Sui University of Technology Sydney, Jingling Xue UNSW DOI Media Attached | ||
09:50 20mTalk | UAFSan: An Object-Identifier-Based Dynamic Approach for Detecting Use-After-Free Vulnerabilities Technical Papers Binfa Gui Nanjing University of Science and Technology, Wei Song Nanjing University of Science and Technology, Jeff Huang Texas A&M University DOI Media Attached File Attached | ||
10:10 20mTalk | Seed Selection for Successful Fuzzing Technical Papers Adrian Herrera Australian National University; DST, Hendra Gunadi Australian National University, Shane Magrath DST, Michael Norrish CSIRO’s Data61; Australian National University, Mathias Payer EPFL, Tony Hosking Australian National University; CSIRO’s Data61 DOI Pre-print File Attached | ||
10:30 20mTalk | QFuzz: Quantitative Fuzzing for Side Channels Technical Papers DOI Pre-print Media Attached |