一句话：提出 UAFSan，通过为对象和指针分配唯一标识符并校验一致性，在运行时检测 use-after-free 漏洞。
释放后使用（use-after-free, UAF）漏洞严重威胁软件安全，且由于指针别名以及指针与对象之间的复杂关系，人工或静态分析难以检测。现有基于证据的动态检测方法通常只跟踪指针或对象来记录对象可用性，当被释放对象所占内存被重新分配后，这类记录会失效。本文提出 UAFSan：为每个新分配对象及其指针分配唯一标识符，并在指针解引用内存对象时，通过检查两者标识符是否一致来判断是否发生 UAF。作者实现了开源工具，并在大量流行基准和真实程序上评估。实验表明，UAFSan 能在合理开销下检出全部 UAF，而现有公开动态检测器均会漏报部分 UAF。
Use-After-Free (UAF) vulnerabilities constitute severe threats to software security. In contrast to other memory errors, UAFs are more difficult to detect through manual or static analysis due to pointer aliases and complicated relationships between pointers and objects. Existing evidence-based dynamic detection approaches only track either pointers or objects to record the availability of objects, which become invalid when the memory that stored the freed object is reallocated. To this end, we propose an approach UAFSan dedicated to comprehensively detecting UAFs at runtime. Specifically, we assign a unique identifier to each newly-allocated object and its pointers; when a pointer dereferences a memory object, we determine whether a UAF occurs by checking the consistency of their identifiers. We implement UAFSan in an open-source tool and evaluate it on a large collection of popular benchmarks and real-world programs. The experiment results demonstrate that UAFSan successfully detect all UAFs with reasonable overhead, whereas existing publicly-available dynamic detectors all miss certain UAFs.
DOI 原文 ·
@inproceedings{paperbot6644,
title = {UAFSan: an object-identifier-based dynamic approach for detecting use-after-free vulnerabilities},
author = {Binfa Gui and Wei Song and Jeff Huang},
booktitle = {ISSTA},
year = {2021},
doi = {10.1145/3460319.3464835}
}