SoK: Sanitizing for Security Dokyung Song , Julian Lettner, Prabhu - PowerPoint PPT Presentation

SoK: Sanitizing for Security Dokyung Song , Julian Lettner, Prabhu Rajasekaran, Yeoul Na, Stijn Volckaert, Per Larsen, Michael Franz

Finding Bugs in C/C++ Manual Analysis Static Analysis Dynamic Analysis AddressSanitizer MemorySanitizer Code Review/Auditing Clang Static Analyzer C/C++ Source Code Program Inputs Hand-written test suite american fuzzy lop libFuzzer May 2019 2

Finding Bugs in C/C++ Manual Analysis Static Analysis Dynamic Analysis AddressSanitizer MemorySanitizer Code Review/Auditing Clang Static Analyzer C/C++ Source Code Program Inputs Hand-written test suite american fuzzy lop libFuzzer May 2019 3

Dynamic Analysis Tools for C/C++ • More than 35 years of research in Dynamic Analysis Tools – often-called “ Sanitizers ” – that find vulnerabilities specific to C/C++ Oscar Undangle FreeSentry HexType SoftBounds+CETS SGXBounds TySan Dr. Memory CaVer EffectiveSan Purify MSCC LBC TypeSan CUP Electric Fence Memcheck PAriCheck UBSan MSan DangSan Bcc RTCC Safe-C P&F PageHeap CRED D&A BBC ASan DangNull Low-Fat CRCount 1980 1990 1995 2000 2005 2010 2015 2019 May 2019 4

Exploit Mitigation vs. Sanitization (1/2) Attack Flow Heap Overflow Function Pointer Overwrite Integer Overflow + Indirect Call May 2019 5

Exploit Mitigation vs. Sanitization (1/2) Exploit Mitigation Security Policies Sanitization Policies Memory Safety Code Pointer Integrity Control-Flow Integrity Attack Flow Heap Overflow Function Pointer Overwrite Integer Overflow + Indirect Call UndefinedBehaviorSanitizer AddressSanitizer … and many others May 2019 6

Exploit Mitigation vs. Sanitization (1/2) Exploit Mitigation Security Policies Sanitization Policies Memory Safety Code Pointer Integrity Control-Flow Integrity Attack Flow Heap Overflow Function Pointer Overwrite Integer Overflow + Indirect Call UndefinedBehaviorSanitizer AddressSanitizer … and many others May 2019 7

Exploit Mitigation vs. Sanitization (2/2) Exploit Mitigation Sanitization The goal is to … Mitigate attacks Find vulnerabilities Used in … Production Pre-release Performance budget is … Very limited Much higher Policy violation leads to … Program termination Problem diagnosis Violations triggered at location of bug Sometimes Always Tolerance for FPs is … Zero Somewhat higher Surviving benign errors is … Desired Not desired May 2019 8

Undefined Behavior in C/C++ • Buffer overflow J.2 Undefined behavior • Use-after-free The behavior is undefined in the following circumstances: … • Type errors — Addition or subtraction of a pointer into, or just beyond, an • Format string bug array object and an integer type produces a result that does not point into, or just beyond, the same array object (6.5.6). • Signed integer overflow … • Null pointer dereferences — An object is referred to outside of its lifetime (6.2.4). • etc. … — A pointer is used to call a function whose type is not compatible with the referenced type. … — An object has its stored value accessed other than by an lvalue of an allowable type (6.5). … May 2019 9

Undefined Behavior in C/C++ • Buffer overflow J.2 Undefined behavior • Use-after-free The behavior is undefined in the following circumstances: … • Type errors — Addition or subtraction of a pointer into, or just beyond, an • Format string bug array object and an integer type produces a result that does not point into, or just beyond, the same array object (6.5.6). • Signed integer overflow … • Null pointer dereferences — An object is referred to outside of its lifetime (6.2.4). • etc. … — A pointer is used to call a function whose type is not → Well-known Security Vulnerabilities compatible with the referenced type. … — An object has its stored value accessed other than by an lvalue of an allowable type (6.5). … May 2019 10

Security Implications of Undefined Behavior in C/C++ (1/2) 1. Memory and type safety violations vulnerable to memory exploits tun= NULL Null-pointer sk = tun->sk; Dereference Null-pointer mov rsi, QWORDPTR[rdi+8] Dereference Compile Source Code Binary Code May 2019 11

Security Implications of Undefined Behavior in C/C++ (2/2) 2. Compilation of a program having UBs may result in vulnerable code tun= NULL Null-pointer sk = tun->sk; Dereference if (!tun) return POLLERR; ? Compile // privileged code Source Code Binary Code May 2019 12

Security Implications of Undefined Behavior in C/C++ (2/2) 2. Compilation of a program having UBs may result in vulnerable code tun= NULL Null-pointer sk = tun->sk; Dereference if (!tun) return POLLERR; ? Compile // privileged code Source Code Binary Code Null pointer check gets eliminated (akin to CVE-2009-1897) May 2019 13

Security Implications of Undefined Behavior in C/C++ (2/2) 2. Compilation of a program having UBs may result in vulnerable code tun= NULL Null-pointer sk = tun->sk; Dereference Privilege // privileged code Escalation if (!tun) return POLLERR; Compile mov rsi, QWORDPTR[rdi+8] // privileged code Source Code Binary Code Null pointer check gets eliminated (akin to CVE-2009-1897) May 2019 14

Low-Level Vulnerabilities in C/C++ (1/2) Temporal Use of Spatial Memory Pointer Type Variadic Other Memory Safety Uninitialized Safety Violation Errors Function Misuse Vulnerabilities Violation Variables Integer Bad Casting Overflow Other Pointer Other UBs Type Errors • Most of these vulnerabilities can manifest as memory and type safety violations. May 2019 15

Low-Level Vulnerabilities in C/C++ (2/2) Temporal Use of Spatial Memory Pointer Type Variadic Other Memory Safety Uninitialized Safety Violation Errors Function Misuse Vulnerabilities Violation Variables Integer Bad Casting Overflow Other Pointer Other UBs Type Errors • Some UBs may lead to unsafe code generation today. • And, things can change as compiler optimizations evolve – called time- bombs *. * W. Dietz, P. Li, J. Regher, and V. Adve; “Understanding integer overflow in C/C++.” In ICSE , 2012. May 2019 16

Low-Level Vulnerabilities in C/C++ (2/2) Temporal Use of Spatial Memory Pointer Type Variadic Other Memory Safety Uninitialized Safety Violation Errors Function Misuse Vulnerabilities Violation Variables Integer Bad Casting -ftrivial-auto- Overflow var-init=zero -fwrapv -ftrapv Other Pointer Other UBs Type Errors -fno-strict- aliasing -fno-delete-null- pointer-checks • Some UBs may lead to unsafe code generation today. • And, things can change as compiler optimizations evolve – called time- bombs *. * W. Dietz, P. Li, J. Regher, and V. Adve; “Understanding integer overflow in C/C++.” In ICSE , 2012. May 2019 17

Sanitizer Design and Implementation Temporal Use of Spatial Memory Pointer Type Variadic Function Other Memory Safety Uninitialized Safety Violation Errors Misuse Vulnerabilities Violation Variables Red-zone Uninitialized Pointer Dangerous Stateless Insertion Reuse Delay Memory Read Casting Format String Monitoring (Guard Pages) Detection Monitor Detection Per-pointer Uninitialized Argument Pointer Use Bounds Value Use Mismatch Lock-and-key Monitor Tracking Detection Detection Per-object Dangling Bounds Pointer Tracking Tagging Bug Finding Technique Program Instrumentation Metadata Management Embedded (a) Dynamic Metadata (b) Static Metadata 11101110101 0 check(); call check 101010110101 010101011010 *ptr = 3; store ptr Object Pointer Instruction Disjoint … … (a) Language-level (b) IR-level (c) Binary Others Instrumentation Instrumentation Instrumentation May 2019 18

Sanitizer Design and Implementation: Bug Finding Techniques Bug Finding Techniques Temporal Use of Spatial Memory Pointer Type Variadic Function Other Class of Bugs Memory Safety Uninitialized Safety Violation Errors Misuse Vulnerabilities Violation Variables Red-zone Uninitialized Pointer Dangerous Stateless Insertion Reuse Delay Memory Read Casting Format String Monitoring (Guard Pages) Detection Monitor Detection Bug Finding Per-pointer Uninitialized Argument Pointer Use Technique Bounds Lock-and-key Value Use Mismatch Monitor Tracking Detection Detection Per-object Dangling Bounds Pointer Tracking Tagging May 2019 19

Sanitizer Design and Implementation: Program Instrumentation Program Instrumentation Inlined Reference Monitor: Fine-grained run-time monitoring of program behavior to detect bugs as they occur. Source code Intermediate Representation Binary External (C/C++) (e.g., LLVM IR) call Libraries 11101110101 check(); call check 01010101101 (d) Library Interposition store ptr 01010101011 *ptr = 3; Compiler 0101 Compiler LD_PRELOAD for instrumenting only Frontend Backend calls to dynamically-linked external library functions (a) Language-level (b) IR-level (c) Binary-level May 2019 20