[SW Security] CRCount: Pointer Invalidation with Reference Counting to Mitigate Use-after-free in Legacy C/C++, Network and Distributed System Security Symposium (NDSS), Feb. 2019

CRCount: Pointer Invalidation with Reference Counting to Mitigate Use-after-free in Legacy C/C++, Network and Distributed System Security Symposium (NDSS) 2019


Jangseop Shin, Donghyun Kwon, Jiwon Seo, Yeongpil Cho, Yunheung Paek


본 논문은 C/C++ 프로그램에 대한 공격으로 많이 사용되는 Use-after-free 취약점에 대한 방어 기법을 제안한다. 이를 위해 컴파일 단계에서 코드를 수정하여 Heap object에 대한 Reference Counting을 수행하여 이를 통해 Heap object의 해제를 dangling pointer가 없어질 때까지 지연시킨다. 또한 실험을 통해 이 approach의 효율성을 보여주었다.

0
0

International Papers

SW Security MetaSafe: Compiling for Protecting Smart Pointer Metadata to Ensure Safe Rust Integrity, USENIX Security 2024
SW Security KVSEV: Secure In-Memory Key-Value Store on AMD Secure Encrypted Virtualization, SoCC 2023
SW Security ZOMETAG: Zone-based Memory Tagging for Fast, Deterministic Detection of Spatial Memory Violations on ARM, IEEE Transactions on Information Forensics and Security (Impact Factor: 7.23)
SW Security SFITAG: Efficient Software Fault Isolation with Memory Tagging for ARM Kernel Extensions, ASIACCS 2023
SW Security TRUST: A compilation framework for in-process isolation to protect safe rust against untrusted code, USENIX Security 2023
SW Security Practical Binary Code Similarity Detection with BERT-based Transferable Similarity Learning, ACSAC 2022
SW Security Exploring Effective Uses of the Tagged Memory for Reducing Bounds Checking Overheads (early access), The Journal of Supercomputing, July 2022
SW Security ExpRace: Exploiting Kernel Races through Raising Interrupts (conditional accept), USENIX Security Symposium (Security), August 2021
SW Security Constraint-guided Directed Greybox Fuzzing (conditional accept), USENIX Security Symposium (Security), August 2021
SW Security M2MON: Building an MMIO-based Security Reference Monitor for Unmanned Vehicles (to appear), USENIX Security Symposium (Security), August 2021
SW Security KARD: Lightweight Data Race Detection with Per-Thread Memory Protection (to appear), International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), April 2021
SW Security BlackMirror: Preventing Wallhacks in 3D Online FPS Games, ACM Conference on Computer and Communications Security (CCS), Nov 2020
SW Security CrFuzz: Fuzzing Multi-purpose Programs through Input Validation, ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (FSE), Nov 2020
SW Security Vessels: Efficient and Scalable Deep Learning Prediction on Trusted Processors, ACM Symposium on Cloud Computing (SoCC), Oct 2020
SW Security Exploiting Kernel Races through Taming Thread Interleaving, BlackHat USA, Sep 2020
SW Security A Tale of Two Trees: One Writes, and Other Reads. Optimized Oblivious Accesses to Large-Scale Blockchains, Privacy Enhancing Technologies Symposium (PETS), July 2020
SW Security HFL: Hybrid Fuzzing on the Linux Kernel, Network and Distributed System Security Symposium (NDSS), Feb 2020
SW Security SBGen: A Framework to Efficiently Supply Runtime Information for a Learning-based HIDS for Multiple Virtual Machines(early access), IEEE Access, Nov 2020
SW Security Data Randomization for Multi-Variant Execution Environment, International SoC Design Conference (ISOCC), October 2019
SW Security Towards Efficient Multi-Variant Execution Environment, International SoC Design Conference (ISOCC), October 2019