TIED, LibsafePlus: Tools for Runtime Buffer Overflow Protection

(una lettura abbastanza interessante)
Reply-To: 
X-PGP-Key: http://www.linux.it/~gaetano/gaetano.asc

http://www.cse.iitk.ac.in/users/deepak/papers/usenix-sec04/

   Buffer overflow exploits make use of the treatment of strings in C as
   character arrays rather than as first-class objects. Manipulation of
   arrays as pointers and primitive pointer arithmetic make it possible
   for a program to access memory locations which it is not supposed to
   access. There have been many efforts in the past to overcome this
   vulnerability by performing array bounds checking in C. Most of these
   solutions are either inadequate, inefficient or incompatible with
   legacy code. In this paper, we present an efficient and transparent
   runtime approach for protection against all known forms of buffer
   overflow attacks. Our solution consists of two tools: TIED (Type
   Information Extractor and Depositor) and LibsafePlus. TIED extracts
   size information of all global and automatic buffers defined in the
   program from the debugging information produced by the compiler and
   inserts it back in the program binary as a data structure available at
   runtime. LibsafePlus is a dynamic library which provides wrapper
   functions for unsafe C library functions such as strcpy. These wrapper
   functions check the source and target buffer sizes using the
   information made available by TIED and perform the requested operation
   only when it is safe to do so. For dynamically allocated buffers, the
   sizes and starting addresses are recorded at runtime. With our simple
   design we are able to protect most applications with a performance
   overhead of less than 10%.

gaetano
(moderatore)

________________________________________________________
http://www.sikurezza.org - Italian Security Mailing List