Gollum: modular and greybox exploit generation for heap overflows in interpreters
We present the first approach to automatic exploit generation for heap overflows in interpreters. It is also the first approach to exploit generation in any class of program that integrates a solution for automatic heap layout manipulation. At the core of the approach is a novel method for discoveri...
| Main Authors: | , , |
|---|---|
| Format: | Conference item |
| Published: |
ACM Digital Library
2019
|
| _version_ | 1826265304662016000 |
|---|---|
| author | Heelan, S Melham, T Kroening, D |
| author_facet | Heelan, S Melham, T Kroening, D |
| author_sort | Heelan, S |
| collection | OXFORD |
| description | We present the first approach to automatic exploit generation for heap overflows in interpreters. It is also the first approach to exploit generation in any class of program that integrates a solution for automatic heap layout manipulation. At the core of the approach is a novel method for discovering exploit primitives—inputs to the target program that result in a sensitive operation, such as a function call or a memory write, utilizing attacker-injected data. To produce an exploit primitive from a heap overflow vulnerability, one has to discover a target data structure to corrupt, ensure an instance of that data structure is adjacent to the source of the overflow on the heap, and ensure that the post-overflow corrupted data is used in a manner desired by the attacker. Our system addresses all three tasks in an automatic, greybox, and modular manner. Our implementation is called GOLLUM, and we demonstrate its capabilities by producing exploits from 10 unique vulnerabilities in the PHP and Python interpreters, 5 of which do not have existing public exploits. |
| first_indexed | 2024-03-06T20:21:35Z |
| format | Conference item |
| id | oxford-uuid:2df77994-1bcf-4ae8-85a1-5619191fe829 |
| institution | University of Oxford |
| last_indexed | 2024-03-06T20:21:35Z |
| publishDate | 2019 |
| publisher | ACM Digital Library |
| record_format | dspace |
| spelling | oxford-uuid:2df77994-1bcf-4ae8-85a1-5619191fe8292022-03-26T12:46:17ZGollum: modular and greybox exploit generation for heap overflows in interpretersConference itemhttp://purl.org/coar/resource_type/c_5794uuid:2df77994-1bcf-4ae8-85a1-5619191fe829Symplectic Elements at OxfordACM Digital Library2019Heelan, SMelham, TKroening, DWe present the first approach to automatic exploit generation for heap overflows in interpreters. It is also the first approach to exploit generation in any class of program that integrates a solution for automatic heap layout manipulation. At the core of the approach is a novel method for discovering exploit primitives—inputs to the target program that result in a sensitive operation, such as a function call or a memory write, utilizing attacker-injected data. To produce an exploit primitive from a heap overflow vulnerability, one has to discover a target data structure to corrupt, ensure an instance of that data structure is adjacent to the source of the overflow on the heap, and ensure that the post-overflow corrupted data is used in a manner desired by the attacker. Our system addresses all three tasks in an automatic, greybox, and modular manner. Our implementation is called GOLLUM, and we demonstrate its capabilities by producing exploits from 10 unique vulnerabilities in the PHP and Python interpreters, 5 of which do not have existing public exploits. |
| spellingShingle | Heelan, S Melham, T Kroening, D Gollum: modular and greybox exploit generation for heap overflows in interpreters |
| title | Gollum: modular and greybox exploit generation for heap overflows in interpreters |
| title_full | Gollum: modular and greybox exploit generation for heap overflows in interpreters |
| title_fullStr | Gollum: modular and greybox exploit generation for heap overflows in interpreters |
| title_full_unstemmed | Gollum: modular and greybox exploit generation for heap overflows in interpreters |
| title_short | Gollum: modular and greybox exploit generation for heap overflows in interpreters |
| title_sort | gollum modular and greybox exploit generation for heap overflows in interpreters |
| work_keys_str_mv | AT heelans gollummodularandgreyboxexploitgenerationforheapoverflowsininterpreters AT melhamt gollummodularandgreyboxexploitgenerationforheapoverflowsininterpreters AT kroeningd gollummodularandgreyboxexploitgenerationforheapoverflowsininterpreters |