Top Banner
Practical Memory Safety with REST KANAD SINHA & SIMHA SETHUMADHAVAN COLUMBIA UNIVERSITY
47

Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Jul 14, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Practical Memory Safety with REST

KANAD SINHA & SIMHA SETHUMADHAVAN

COLUMBIA UNIVERSITY

Page 2: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Is memory safety relevant?

In 2017, 55% of remote-code execution causing bugs in Microsoft due to memory errors

Page 3: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Is memory safety relevant?

Yes!

Page 4: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Practical memory safetyPresenting…

Random Embedded Security Tokens or REST

Core H/W primitive: Insert known 64B random value (token)in program and detect accesses to them.

Page 5: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Practical memory safetyPresenting…

Random Embedded Security Tokens or REST

Core H/W primitive: Insert known 64B random value (token)in program and detect accesses to them.

Otherallocs

bufchar *buf = malloc(BUF_LEN);

for (i=0; i<out_of_bounds; i++)buf = 0;

Heap

Page 6: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Practical memory safetyPresenting…

Random Embedded Security Tokens or REST

Core H/W primitive: Insert known 64B random value (token)in program and detect accesses to them.

char *buf = malloc(BUF_LEN);

for (i=0; i<out_of_bounds; i++)buf = 0;

Otherallocs

buf

Heap

Token

Token

Page 7: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Practical memory safetyPresenting…

Random Embedded Security Tokens or REST

Core H/W primitive: Insert known 64B random value (token)in program and detect accesses to them.

• Trivial hardware implementation

• Software framework based on AddressSanitizer

• Provides heap safety for legacy binaries

Page 8: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Background: Spatial Memory Safety

Zoey’s HouseYana’s HouseXander’s House

Page 9: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Background: Spatial Memory Safety

bufchar *ptrbuf = malloc(BUF_LEN);… ptrbuf[in_bounds] = X;…ptrbuf[out_of_bounds] = Y;

ptrbuf

Page 10: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Background: Spatial Memory Safety

bufchar *ptrbuf = malloc(BUF_LEN);… ptrbuf[in_bounds] = X;…ptrbuf[out_of_bounds] = Y;

ptrbuf

Page 11: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Background: Spatial Memory Safety

bufchar *ptrbuf = malloc(BUF_LEN);… ptrbuf[in_bounds] = X;…ptrbuf[out_of_bounds] = Y;

ptrbuf

Page 12: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Xander’s House

Background: Temporal Memory Safety

Xander moves out, Will moves in

Zoey’s HouseYana’s House

Page 13: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Background: Temporal Memory Safety

Will’s House

Xander moves out, Will moves in

Zoey’s HouseYana’s House

Page 14: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Background: Temporal Memory Safety

bufchar *ptrbuf = malloc(BUF_LEN);ptrbuf[in_bounds] = X;…free(ptrbuf);ptrbuf[in_bounds] = Y;

ptrbuf

Page 15: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Background: Temporal Memory Safety

char *ptrbuf = malloc(BUF_LEN);ptrbuf[in_bounds] = X;…free(ptrbuf);ptrbuf[in_bounds] = Y;

ptrbuf

Page 16: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Previous H/W SolutionsMainly categorizable into 2 types.

Page 17: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Previous H/W Solutions

bufptrbuf

Mainly categorizable into 2 types.

• Whitelisting: Pointer based+ Good coverage

+ Temporal safety (for some)

- Performance overhead

- Implementation overhead

- Imprecise

Page 18: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Previous H/W SolutionsMainly categorizable into 2 types.

• Whitelisting: Pointer based+ Good coverage

+ Temporal safety (for some)

- Performance overhead

- Implementation overhead

- Imprecise

• Blacklisting: Location based

+ Fast

- Weaker coverage (has false negatives)

- Implementation overhead

- No temporal protection

bufptr

Page 19: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Buf

Previous H/W Solutions

Tag-based

buf*ptrbuf

Metadatais_valid(ptrbuf)?

Page 20: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Buf

REST: Primitive Overview

Content-based blacklisting

buf*ptrbuf

is(*ptrbuf == token)?

REST primitive has trivial complexity, overhead

Token

Token

Page 21: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

REST: Spatial Memory Safety

Zoey’s HouseYana’s HouseXander’s House

Page 22: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

REST: Temporal Memory SafetyWill gets new house

Zoey’s HouseYana’s House

Page 23: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

REST Software

Page 24: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Heap Safety

• Allocate and bookend region, malloc to program

24

Heap

buf

Page 25: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Heap Safety

• Allocate and bookend region, malloc to program

• REST’ize at free

• Do not reallocate region until heap sufficiently consumed

25

Heap

Page 26: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Heap Safety

• Allocate and bookend region, malloc to program

• REST’ize at free

• Do not reallocate region until heap sufficiently consumed

26

Heap

Spatial Protection

Page 27: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Heap Safety

• Allocate and bookend region, malloc to program

• REST’ize at free

• Do not reallocate region until heap sufficiently consumed

27

Heap

Temporal Protection

Can be enabled for legacy binaries

Page 28: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Previous frame

Stack Safety

28

void foo() {char buf[64];…return;

}

buf

foo‘s frame

Page 29: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Previous frame

Stack Safety

29

buf

void foo() {char rz1[64];char buf[64];char rz2[64];arm(rz1);arm(rz2);…disarm(rz1);disarm(rz2);return;

}

rz1

rz2

foo‘s frame

Page 30: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Previous frame

Stack Safety

30

buf

void foo() {char rz1[64];char buf[64];char rz2[64];arm(rz1);arm(rz2);…disarm(rz1);disarm(rz2);return;

}

rz1

rz2

foo‘s frame

char rz1[64];char buf[64];char rz2[64];

Page 31: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Previous frame

Stack Safety

31

buf

void foo() {char rz1[64];char buf[64];char rz2[64];arm(rz1);arm(rz2);…disarm(rz1);disarm(rz2);return;

}

rz1

rz2

foo‘s frame

arm rz1;arm rz2;

arm: Set token

Page 32: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Previous frame

Stack Safety

32

buf

void foo() {char rz1[64];char buf[64];char rz2[64];arm(rz1);arm(rz2);…disarm(rz1);disarm(rz2);return;

}

rz1

rz2

foo‘s framedisarm rz1;disarm rz2; disarm: Unset token

Page 33: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Previous frame

Stack Safety

33

buf

void foo() {char rz1[64];char buf[64];char rz2[64];arm(rz1);arm(rz2);…disarm(rz1);disarm(rz2);return;

}

rz1

rz2

foo‘s frame

Requires recompilation with REST plugin

Page 34: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

REST Hardware

Page 35: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Naïve Design

Every store involves an extra load Complicated and expensive

L1-D Memory

Core

=

TokenValue

load/store X

Page 36: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Cache Modifications

Comparator at L1-D mem interface + 1b per L1-D line

L1-D Memory

Core

load/store XTo

ken B

its

=

TokenValue

Page 37: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Cache Miss

L1-D Memory

Core

load/store XTo

ken B

its

=

TokenValue

Page 38: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Cache Hit

L1-D Memory

Core

=

TokenValue

load/store XTo

ken B

its

Page 39: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Cache Eviction

L1-D Memory

Core

=

TokenValue

load/store XTo

ken B

its

Armed outgoing line filled with token value

Page 40: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

What about the core?TODO: Have to support arms and disarms

• 512b writes

• Special semantics: can only touch token with disarm

LSQ design concerns:

• Forwarding would break semantics

• 512b data entries

• How to match unaligned token access?

Page 41: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Load-Store QueueAdd 1b tag

Only update token bit

Split regular match logic

AddressCAM

Data

Tokenbit

=

MatchLogic

MatchAddress

• Forwarding breaks semantics

• 512b data entries

• Detecting unaligned token access

6

Page 42: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

Load-Store QueueAdd 1b tag

Only update token bit

Split regular match logic

AddressCAM

Data

Tokenbit

=

=

MatchLogic

RESTViolation

6

MatchAddress

• Forwarding breaks semantics

• 512b data entries

• Detecting unaligned token access

Page 43: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

REST Overhead

Page 44: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

REST Performance

Page 45: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

REST Performance

Page 46: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

REST Performance

REST primitive overhead near-zero. Software overhead mostly from allocator.

Page 47: Practical Memory Safety with REST · Core = Token Value load/store X. Cache Modifications Comparator at L1-D mem interface + 1b per L1-D line L1-D Memory Core load/store X its = Token

To conclude…

REST: Hardware/software mechanism to detect common memory safety errors◦ Low overhead, low complexity hardware implementation

◦ Heap safety for legacy binaries

22-90% faster than comparable software solution on SPEC CPU

Questions?


Related Documents
Rally Documentation · • Task runner: repeat this ... we ran a Keystone token creation benchmark with Rally under different load ... Rally Documentation, ...

Rally Documentation · • Task runner: repeat this ... we....

Category: Documents
Effiziente ProgrammeAusgangssituation cycles:u 37,109,028,373 cycles:k 410,309,417 instructions 16,409,716,981 branch-miss 106,744,343 L1-load-miss 332,517,306 L1-store-miss ...

Effiziente ProgrammeAusgangssituation cycles:u...

Category: Documents
Token User Guide · Renaming a token 10 Deleting a token 10 Viewing token details 11 Uninstalling Soft Token for Android 11 Soft Token for BlackBerry® 11 Installing Soft Token for

Token User Guide · Renaming a token 10 Deleting a token 10...

Category: Documents
@let@token Français 415 - @let@token 24 janvier 2020

@let@token Français 415 - @let@token 24 janvier 2020

Category: Documents
BGG WhitepaperBGG Whitepaper Official Site: bgogo.com v1.0 Contents Introduction of Bgogo Exchange BGG Token Plan What is BGG BGG Token Distribution Token Distribution Breakdown Token

BGG WhitepaperBGG Whitepaper Official Site: bgogo.com v1.0.....

Category: Documents
Blockstack Token Sale Mechanics - CoinList Token Sale Mechanics By Blockstack Token LLC token@blockstack.com DISCLAIMER: The following summary of terms and description of the sale

Blockstack Token Sale Mechanics - CoinList Token Sale...

Category: Documents
TOKEN SALE PROJECT SUMMARY - Goldario · SUMMARY Start of Token Crowd sale: Date 01-07-2020 Duration: 180 days Token symbol: GLD Token standard: ERC-20 (For Token Sale) Soft cap:

TOKEN SALE PROJECT SUMMARY - Goldario · SUMMARY Start of.....

Category: Documents
Multimedia Over FDDI - support.amd.com · comparison of multimedia over FDDI synchronous and ... although Ethernet under light load offers excellent ... token rotation time in ms

Multimedia Over FDDI - support.amd.com · comparison of...

Category: Documents
TECNOLOGÍAS DE CAPA II TOKEN RING ETHERNET FDDI. TOKEN RING.

TECNOLOGÍAS DE CAPA II TOKEN RING ETHERNET FDDI. TOKEN...

Category: Documents
Mobility Control by L2.5 RoutingEthernet L1 L2 L2.5 Label Switch IP TCP L3 L4 L1 Routing L2.5 Routing L3 Routing. BS = L3 Router ... L3 Routing L2.5 Routing L1 Routing Load Balancing

Mobility Control by L2.5 RoutingEthernet L1 L2 L2.5 Label...

Category: Documents
SafeNet’s Tokenization Manager · > Token Vault - holding the tokens and keys information: > Two tables are added: Token Vault & Key Table > Token Server- running the Token Manager

SafeNet’s Tokenization Manager · > Token Vault - holding...

Category: Documents
Technology and software trends Token Coherenceresearch.cs.wisc.edu/multifacet/theses/milo_martin_phd_talk_6up.pdf · slide 33 Token Coherence – Milo Martin Token Counting Overheads

Technology and software trends Token...

Category: Documents