CRCount: Pointer Invalidation with Reference Counting to Mitigate Use-after-free in Legacy C/C++, Network and Distributed System Security Symposium (NDSS), Feb. 2019 > International Papers

[SW Security] CRCount: Pointer Invalidation with Reference Counting to Mitigate Use-after-free in Legacy C/C++, Network and Distributed System Security Symposium (NDSS), Feb. 2019

0
0
Print
11-07

CRCount: Pointer Invalidation with Reference Counting to Mitigate Use-after-free in Legacy C/C++, Network and Distributed System Security Symposium (NDSS) 2019

Jangseop Shin, Donghyun Kwon, Jiwon Seo, Yeongpil Cho, Yunheung Paek

본 논문은 C/C++ 프로그램에 대한 공격으로 많이 사용되는 Use-after-free 취약점에 대한 방어 기법을 제안한다. 이를 위해 컴파일 단계에서 코드를 수정하여 Heap object에 대한 Reference Counting을 수행하여 이를 통해 Heap object의 해제를 dangling pointer가 없어질 때까지 지연시킨다. 또한 실험을 통해 이 approach의 효율성을 보여주었다.

0
0

International Papers

SW Security ROSEC: Intra-Process Isolation for ROS Composition with Memory Protection Keys, IEEE Transactions on Automation Science and Engineering (T-ASE, Impact Factor : 5.9), Dec 2024

SW Security Enhancing a Lock-and-Key Scheme With MTE to Mitigate Use-After-Frees, IEEE Access, Dec 2023

SW Security MetaSafe: Compiling for Protecting Smart Pointer Metadata to Ensure Safe Rust Integrity, USENIX Security 2024

SW Security KVSEV: Secure In-Memory Key-Value Store on AMD Secure Encrypted Virtualization, SoCC 2023

SW Security ZOMETAG: Zone-based Memory Tagging for Fast, Deterministic Detection of Spatial Memory Violations on ARM, IEEE Transactions on Information Forensics and Security (Impact Factor: 7.23)

SW Security SFITAG: Efficient Software Fault Isolation with Memory Tagging for ARM Kernel Extensions, ASIACCS 2023

SW Security TRUST: A compilation framework for in-process isolation to protect safe rust against untrusted code, USENIX Security 2023

SW Security Practical Binary Code Similarity Detection with BERT-based Transferable Similarity Learning, ACSAC 2022

SW Security Exploring Effective Uses of the Tagged Memory for Reducing Bounds Checking Overheads (early access), The Journal of Supercomputing, July 2022

SW Security ExpRace: Exploiting Kernel Races through Raising Interrupts (conditional accept), USENIX Security Symposium (Security), August 2021

SW Security Constraint-guided Directed Greybox Fuzzing (conditional accept), USENIX Security Symposium (Security), August 2021

SW Security M2MON: Building an MMIO-based Security Reference Monitor for Unmanned Vehicles (to appear), USENIX Security Symposium (Security), August 2021

SW Security KARD: Lightweight Data Race Detection with Per-Thread Memory Protection (to appear), International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), April 2021

SW Security BlackMirror: Preventing Wallhacks in 3D Online FPS Games, ACM Conference on Computer and Communications Security (CCS), Nov 2020

SW Security CrFuzz: Fuzzing Multi-purpose Programs through Input Validation, ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (FSE), Nov 2020

SW Security Vessels: Efficient and Scalable Deep Learning Prediction on Trusted Processors, ACM Symposium on Cloud Computing (SoCC), Oct 2020

SW Security Exploiting Kernel Races through Taming Thread Interleaving, BlackHat USA, Sep 2020

SW Security A Tale of Two Trees: One Writes, and Other Reads. Optimized Oblivious Accesses to Large-Scale Blockchains, Privacy Enhancing Technologies Symposium (PETS), July 2020

SW Security HFL: Hybrid Fuzzing on the Linux Kernel, Network and Distributed System Security Symposium (NDSS), Feb 2020

SW Security SBGen: A Framework to Efficiently Supply Runtime Information for a Learning-based HIDS for Multiple Virtual Machines(early access), IEEE Access, Nov 2020