Identifying Valuable Pointers in Heap Data

Historically, attackers have sought to manipulate programs through the corruption of return addresses, function pointers, and other control flow data. However, as protections like ASLR, stack canaries, and no-execute bits have made such attacks more difficult, data-oriented exploits have received in...

Full description

Saved in:

Bibliographic Details
Published in:	2021 IEEE Security and Privacy Workshops (SPW) pp. 373 - 382
Main Authors:	Roney, James, Appel, Troy, Pinisetti, Prateek, Mickens, James
Format:	Conference Proceeding
Language:	English
Published:	IEEE 01-05-2021
Subjects:	Conferences Data Oriented Attacks Heap Analysis Layout Memory Analysis Memory Cartography Memory management Navigation Privacy Spraying Transforms
Online Access:	Get full text
Tags:	Add Tag No Tags, Be the first to tag this record!

Description
Summary:	Historically, attackers have sought to manipulate programs through the corruption of return addresses, function pointers, and other control flow data. However, as protections like ASLR, stack canaries, and no-execute bits have made such attacks more difficult, data-oriented exploits have received increasing attention. Such exploits try to subvert a program by reading or writing non-control data, without introducing any foreign code or violating the program's legitimate control flow graph. Recently, a data-oriented exploitation technique called memory cartography was introduced, in which an attacker navigates between allocated memory regions using a precompiled map to disclose sensitive program data. The efficacy of memory cartography is dependent on inter-region pointers being located at constant offsets within memory regions; thus, cartographic attacks are difficult to launch against memory regions like heaps and stacks that have nondeterministic layouts. In this paper, we lower the barrier to successful attacks against nondeterministic memory, demonstrating that pointers between regions of memory often possess unique "signatures" that allow attackers to identify them with high accuracy. These signatures are accurate even when the pointers reside in non-deterministic memory areas. In many real-world programs, this allows an attacker that is capable of reading bytes from a single heap to access all of process memory. Our findings underscore the importance of memory isolation via separate address spaces.
DOI:	10.1109/SPW53761.2021.00057