research-article

Modular Synthesis of Heap Exploits

Authors:

Johannes Kinder, and

Lorenzo CavallaroAuthors Info & Claims

PLAS '17: Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security

October 2017

Pages 25 - 35

https://doi.org/10.1145/3139337.3139346

Published: 30 October 2017 Publication History

Abstract

Memory errors continue to compromise the security of today's systems. Recent efforts to automatically synthesize exploits for stack-based buffer overflows promise to help assess a vulnerability's severity more quickly and alleviate the burden of manual reasoning. However, generation of heap exploits has been out of scope for such methods thus far.

In this paper, we investigate the problem of automatically generating heap exploits, which, in addition to finding the vulnerability, requires intricate interaction with the heap manager. We identify the challenges involved in automatically finding the right parameters and interaction sequences for such attacks, which have traditionally required manual analysis. To tackle these challenges, we present a modular approach that is designed to minimize the assumptions made about the heap manager used by the target application. Our prototype system is able to find exploit primitives in six binary implementations of Windows and UNIX-based heap managers and applies these to successfully exploit two real-world applications.

References

[1]

Anand, S., Godefroid, P., and Tillmann, N. Demand-driven compositional symbolic execution. In TACAS (2008), pp. 367--381.

[2]

Avgerinos, T., Cha, S. K., Hao, B. L. T., and Brumley, D. AEG: Automatic exploit generation. In NDSS (2011).

[3]

Berger, E. D. Heapshield: Library-based heap overflow protection for free. UMass CS TR (2006), 06--28.

[4]

Brumley, D., Poosankam, P., Song, D. X., and Zheng, J. Automatic patch-based exploit generation is possible: Techniques and implications. In IEEE Symposium on Security and Privacy (2008), pp. 143--157.

Digital Library

[5]

Cadar, C., Dunbar, D., and Engler, D. R. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In OSDI (2008), pp. 209--224.

Digital Library

[6]

Cha, S. K., Avgerinos, T., Rebert, A., and Brumley, D. Unleashing mayhem on binary code. In IEEE Symposium on Security and Privacy (2012), pp. 380--394.

Digital Library

[7]

Chipounov, V., Kuznetsov, V., and Candea, G. S2E: a platform for in-vivo multi-path analysis of software systems. In ASPLOS (2011), pp. 265--278.

Digital Library

[8]

DARPA. Cyber grand challenge. Queue 10, 1 (2012), 20.

[9]

Egele, M., Wurzinger, P., Kruegel, C., and Kirda, E. Defending browsers against drive-by downloads: Mitigating heap-spraying code injection attacks. In DIMVA (2009), pp. 88--106.

Digital Library

[10]

Ferguson, J. Understanding the heap by breaking it. In Black Hat USA (2007).

[11]

Futoransky, A., Kargieman, E., Sarraute, C., and Waissbein, A. Foundations and applications for secure triggers. ACM Transactions on Information and System Security (TISSEC) 9, 1 (2006), 94--112.

Digital Library

[12]

Godefroid, P. Compositional dynamic test generation. In POPL (2007), pp. 47--54.

Digital Library

[13]

Godefroid, P., Klarlund, N., and Sen, K. DART: directed automated random testing. In PLDI (2005), V. Sarkar and M. W. Hall, Eds., ACM, pp. 213--223.

Digital Library

[14]

Godefroid, P., Levin, M. Y., and Molnar, D. A. Automated whitebox fuzz testing. In NDSS (2008), The Internet Society.

[15]

Hao, B. L. T. Automatic heap exploit generation. Bachelor»s thesis, Carnegie Mellon University, 2012.

[16]

Heelan, S. Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities. Tech. rep., University of Oxford, 2009.

[17]

Kath, R. Managing heap memory. http://msdn.microsoft.com/en-us/library/ms810603.aspx, Apr. 1993.

[18]

Kuznetsov, V., Kinder, J., Bucur, S., and Candea, G. Efficient state merging in symbolic execution. In PLDI (2012), ACM, pp. 193--204.

Digital Library

[19]

Li, L., Just, J. E., and Sekar, R. Address-space randomization for Windows systems. In ACSAC (2006), pp. 329--338.

Digital Library

[20]

McDonald, J., and Valasek, C. Practical Windows XP/2003 heap exploitation. In Black Hat USA (2009).

[21]

Sharif, M. I., Lanzi, A., Giffin, J. T., and Lee, W. Impeding malware analysis using conditional code obfuscation. In NDSS (2008).

[22]

Sotirov, A. Heap feng shui in JavaScript. Black Hat Europe (2007).

[23]

Sotirov, A., and Dowd, M. Bypassing browser memory protections in Windows Vista. In Blackhat USA (2008).

[24]

Szekeres, L., Payer, M., Wei, T., and Song, D. SoK: Eternal war in memory. In IEEE Symposium on Security and Privacy (2013), IEEE Computer Society, pp. 48--62.

Digital Library

[25]

Valasek, C. Understanding the low fragmentation heap. In Black Hat USA (2010).

[26]

van der Veen, V., dutt Sharma, N., Cavallaro, L., and Bos, H. Memory errors: The past, the present, and the future. In RAID (2012), pp. 86--106.

Digital Library

Cited By

Elder SRahman MFringer GKapoor KWilliams L(2024)A Survey on Software Vulnerability Exploitability AssessmentACM Computing Surveys10.1145/364861056:8(1-41)Online publication date: 26-Apr-2024
https://dl.acm.org/doi/10.1145/3648610
Xu DChen KLin MLin CWang X(2024) AutoPwn : Artifact-Assisted Heap Exploit Generation for CTF PWN Competitions IEEE Transactions on Information Forensics and Security10.1109/TIFS.2023.332231919(293-306)Online publication date: 2024
https://doi.org/10.1109/TIFS.2023.3322319
Jiang ZZhang YXu JSun XLiu ZYang M(2023)AEM: Facilitating Cross-Version Exploitability Assessment of Linux Kernel Vulnerabilities2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179305(2122-2137)Online publication date: May-2023
https://doi.org/10.1109/SP46215.2023.10179305
Show More Cited By

Index Terms

Modular Synthesis of Heap Exploits
1. Security and privacy
  1. Software and application security
  2. Systems security
    1. Vulnerability management

Recommendations

RiscyROP: Automated Return-Oriented Programming Attacks on RISC-V and ARM64
RAID '22: Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses

Return-oriented programming (ROP) is a powerful run-time exploitation technique to attack vulnerable software. Modern RISC architectures like RISC-V and ARM64 pose new challenges for ROP execution due to the lack of a stack-based return instruction and ...
Read More
Determining the Utility of Cyber Vulnerability Implantation: The Heartbleed Bug as a Cyber Operation
MILCOM '14: Proceedings of the 2014 IEEE Military Communications Conference

Flaws in computer software or hardware that are as yet unknown to the public, known as zero-day vulnerabilities, are an increasingly sought-after resource by actors conducting cyber operations. While the objective pursued is commonly defensive, as in ...
Read More
Attack Potential in Impact and Complexity
ARES '17: Proceedings of the 12th International Conference on Availability, Reliability and Security

Vulnerability exploitation is reportedly one of the main attack vectors against computer systems. Yet, most vulnerabilities remain unexploited by attackers. It is therefore of central importance to identify vulnerabilities that carry a high 'potential ...
Read More

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

PLAS '17: Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security

October 2017

128 pages

ISBN:9781450350990

DOI:10.1145/3139337

Program Chairs:
Nataliia Bielova
INRIA, France
,
Marco Gaboardi
University at Buffalo, SUNY, USA

Copyright © 2017 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 30 October 2017

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

EPSRC

Conference

CCS '17

Sponsor:

SIGSAC

CCS '17: 2017 ACM SIGSAC Conference on Computer and Communications Security

October 30, 2017

Texas, Dallas, USA

Acceptance Rates

PLAS '17 Paper Acceptance Rate 8 of 10 submissions, 80%;

Overall Acceptance Rate 43 of 77 submissions, 56%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

19
Total Citations
View Citations
374
Total Downloads

Downloads (Last 12 months)31
Downloads (Last 6 weeks)4

Other Metrics

View Author Metrics

Citations

Cited By

Elder SRahman MFringer GKapoor KWilliams L(2024)A Survey on Software Vulnerability Exploitability AssessmentACM Computing Surveys10.1145/364861056:8(1-41)Online publication date: 26-Apr-2024
https://dl.acm.org/doi/10.1145/3648610
Xu DChen KLin MLin CWang X(2024) AutoPwn : Artifact-Assisted Heap Exploit Generation for CTF PWN Competitions IEEE Transactions on Information Forensics and Security10.1109/TIFS.2023.332231919(293-306)Online publication date: 2024
https://doi.org/10.1109/TIFS.2023.3322319
Jiang ZZhang YXu JSun XLiu ZYang M(2023)AEM: Facilitating Cross-Version Exploitability Assessment of Linux Kernel Vulnerabilities2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179305(2122-2137)Online publication date: May-2023
https://doi.org/10.1109/SP46215.2023.10179305
Jiang ZZhang YXu JSun XLiu ZYang M(2023)AEM: Facilitating Cross-Version Exploitability Assessment of Linux Kernel Vulnerabilities2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179286(2122-2137)Online publication date: May-2023
https://doi.org/10.1109/SP46215.2023.10179286
Tu H(2023)Boosting Symbolic Execution for Heap-based Vulnerability Detection and Exploit Generation2023 IEEE/ACM 45th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)10.1109/ICSE-Companion58688.2023.00059(218-220)Online publication date: May-2023
https://doi.org/10.1109/ICSE-Companion58688.2023.00059
Xu SWang Y(2022)BofAEGSecurity and Communication Networks10.1155/2022/12519872022Online publication date: 1-Jan-2022
https://dl.acm.org/doi/10.1155/2022/1251987
Gennissen JO'Keeffe D(2022)Hack the Heap: Heap Layout Manipulation made Easy2022 IEEE Security and Privacy Workshops (SPW)10.1109/SPW54247.2022.9833896(289-300)Online publication date: May-2022
https://doi.org/10.1109/SPW54247.2022.9833896
Zhang BDeng F(2022)Tetris: Automatic UAF Exploit Generation by Manipulating Layout based on Reactivated Paths2022 23rd ACIS International Summer Virtual Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD-Summer)10.1109/SNPD-Summer57817.2022.00010(1-8)Online publication date: Jul-2022
https://doi.org/10.1109/SNPD-Summer57817.2022.00010
Liu QBao KHagenmeyer V(2022)Binary Exploitation in Industrial Control Systems: Past, Present and FutureIEEE Access10.1109/ACCESS.2022.317192210(48242-48273)Online publication date: 2022
https://doi.org/10.1109/ACCESS.2022.3171922
Kang XDebray SHauser CKwon YBanescu S(2021)A Framework for Automatic Exploit Generation for JIT CompilersProceedings of the 2021 Research on offensive and defensive techniques in the Context of Man At The End (MATE) Attacks10.1145/3465413.3488573(11-19)Online publication date: 19-Nov-2021
https://dl.acm.org/doi/10.1145/3465413.3488573
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents