Detecting Memory Life-Cycle Bugs With Extended Define-Use Chain Analysis
OS kernels leverage various memory allocation functions to carry out memory allocation, and memory data in kernel space of OS should be cautiously handled, e.g., allocating with kmalloc() and freeing with kfree(). However, real cases do exist where memory data is incorrectly allocated/freed, not che...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2020-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9106323/ |
| _version_ | 1818616688774479872 |
|---|---|
| author | Gen Zhang |
| author_facet | Gen Zhang |
| author_sort | Gen Zhang |
| collection | DOAJ |
| description | OS kernels leverage various memory allocation functions to carry out memory allocation, and memory data in kernel space of OS should be cautiously handled, e.g., allocating with kmalloc() and freeing with kfree(). However, real cases do exist where memory data is incorrectly allocated/freed, not checked before dereferenced, or left unfreed when out of use. We define these cases as Memory Life-cycle (MLC) bugs, and according to what we know, this new type of software bugs has not been deeply researched yet. In this paper, we go deep into the life-cycle of kernel memory space, including allocation, dereference and free, and propose the first systematical study of MLC bugs and build an automated and scalable detection framework, MLC bug sanitizer (MLCSan). MLCSan is capable of revealing memory allocation and free functions OS kernels. Besides, the occurrences of allocating, dereferencing and freeing sites can be automatically detected by MLCSan, leading to cases where MLC bugs may appear. Moreover, experiment result of analyzing the latest mainline OS kernels with MLCSan is a strong proof that MLCSan is effective in detecting MLC bugs and can scale to different platforms, in which 41 new bugs are identified in Linux and FreeBSD. And undoubtedly, we will open source MLCSan prototype to contribute to the security research in this area. |
| first_indexed | 2024-12-16T16:53:47Z |
| format | Article |
| id | doaj.art-96a83e9c77be42c1bb82375606e9a1c7 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-16T16:53:47Z |
| publishDate | 2020-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-96a83e9c77be42c1bb82375606e9a1c72022-12-21T22:23:57ZengIEEEIEEE Access2169-35362020-01-01811496811498010.1109/ACCESS.2020.29993519106323Detecting Memory Life-Cycle Bugs With Extended Define-Use Chain AnalysisGen Zhang0https://orcid.org/0000-0001-7709-0751College of Computer, National University of Defense Technology, Changsha, ChinaOS kernels leverage various memory allocation functions to carry out memory allocation, and memory data in kernel space of OS should be cautiously handled, e.g., allocating with kmalloc() and freeing with kfree(). However, real cases do exist where memory data is incorrectly allocated/freed, not checked before dereferenced, or left unfreed when out of use. We define these cases as Memory Life-cycle (MLC) bugs, and according to what we know, this new type of software bugs has not been deeply researched yet. In this paper, we go deep into the life-cycle of kernel memory space, including allocation, dereference and free, and propose the first systematical study of MLC bugs and build an automated and scalable detection framework, MLC bug sanitizer (MLCSan). MLCSan is capable of revealing memory allocation and free functions OS kernels. Besides, the occurrences of allocating, dereferencing and freeing sites can be automatically detected by MLCSan, leading to cases where MLC bugs may appear. Moreover, experiment result of analyzing the latest mainline OS kernels with MLCSan is a strong proof that MLCSan is effective in detecting MLC bugs and can scale to different platforms, in which 41 new bugs are identified in Linux and FreeBSD. And undoubtedly, we will open source MLCSan prototype to contribute to the security research in this area.https://ieeexplore.ieee.org/document/9106323/Systems securitysoftware and application security |
| spellingShingle | Gen Zhang Detecting Memory Life-Cycle Bugs With Extended Define-Use Chain Analysis IEEE Access Systems security software and application security |
| title | Detecting Memory Life-Cycle Bugs With Extended Define-Use Chain Analysis |
| title_full | Detecting Memory Life-Cycle Bugs With Extended Define-Use Chain Analysis |
| title_fullStr | Detecting Memory Life-Cycle Bugs With Extended Define-Use Chain Analysis |
| title_full_unstemmed | Detecting Memory Life-Cycle Bugs With Extended Define-Use Chain Analysis |
| title_short | Detecting Memory Life-Cycle Bugs With Extended Define-Use Chain Analysis |
| title_sort | detecting memory life cycle bugs with extended define use chain analysis |
| topic | Systems security software and application security |
| url | https://ieeexplore.ieee.org/document/9106323/ |
| work_keys_str_mv | AT genzhang detectingmemorylifecyclebugswithextendeddefineusechainanalysis |