Heap-based attacks depend on a combination of memory management errors and an exploitable memory allocator. Many allocators include ad hoc countermeasures against particular exploits, but their effectiveness against future exploits has been uncertain. This paper presents the first formal treatment of the impact of allocator design on security. It analyzes a range of widely-deployed memory allocators, including those used by Windows, Linux, FreeBSD, and OpenBSD, and shows that they remain vulnerable to attack. It then presents DieHarder, a new allocator whose design was guided by this analysis. DieHarder provides the highest degree of security from heap-based attacks of any practical allocator of which we are aware, while imposing modest performance overhead. In particular, the Firefox web browser runs as fast with DieHarder as with the Linux allocator.

1. DIEHARDER:
SECURING
THE
HEAP
Gene
Novark
&
Emery
Berger
University
of
Massachusetts,
Amherst
[originally
presented
at
CCS
ASSACHUSETTS,
AMHERST
•
Department
of
Computer
Science
UNIVERSITY
OF
M 2011]

2. DieHard:
ProbabilisFc
Memory
Safety
for
C/C++
Programs
[PLDI
2005]
Direct
inspira4on
for
Windows
7’s
Fault-­‐Tolerant
Heap
(2009)
UNIVERSITY
OF
MASSACHUSETTS,
AMHERST
•
Department
of
Computer
Science

3. DieHard:
ProbabilisFc
Memory
Safety
for
C/C++
Programs
[PLDI
2005]
Direct
inspira4on
for
Windows
7’s
Fault-­‐Tolerant
Heap
(2009)
UNIVERSITY
OF
MASSACHUSETTS,
AMHERST
•
Department
of
Computer
Science

14. 14

15. 15

16. 16

17. 17

20. 20

23. 23

24. 24

25. 25

26. 26

27. 27

28. 28

29. 29

30. 30

31. 31

32. sensitive
data
/
metadata
32

33. sensitive
data
/
metadata
All data / metadata sensitive
33

34. guard
/
unmapped
page
34

35. guard
/
unmapped
page
35

36. 36

37. 37

38. 38

39. Address-­‐space
layout
randomization
39

40. object free space
heap metadata

41. prev. object
object free space
object size
heap metadata
(GNU libc, others)

42. object x free space
heap metadata

43. object x free space
heap metadata

44. 44

45. 45

46. 46

47. 47

48. 48

49. 49

50. 50

51. ≈ 4-5 bits of entropy
51

52. 52

53. Maximal entropy:
log N bits (e.g., ≈ 25-30)
53

54. 54

57. 44.2 sec

58. 44.2 sec 41.6 sec

59. DIEHARDER:
SECURING
THE
HEAP
Gene
Novark
&
Emery
Berger
University
of
Massachusetts,
Amherst
UNIVERSITY
OF
MASSACHUSETTS,
AMHERST
•
Department
of
Computer
Science