HeapSentry: kernel-assisted protection against heap overflows

摘要: The last twenty years have witnessed the constant reaction of security community to memory corruption attacks and evolution attacking techniques in order circumvent newly-deployed countermeasures. In this evolution, heap a process received little attention thus today, problem overflows is largely unsolved. In paper we present HeapSentry, system designed detect stop overflow through cooperation allocation library program operating system's kernel. HeapSentry places unique random canaries at end each object which are later checked by kernel, before calls allowed proceed. operates on binaries (no source code needed) has, design, no false-positives. At same time, active involvement kernel provides stronger guarantees than current state art protection mechanisms for modest performance overhead.