KR20190065841A - Memory error detection method - Google Patents

Abstract

The present invention relates to a memory error detection method and, more specifically, to a region-based memory error detection method which may be applied to a large-scale application and fuzz testing. According to the present invention, the memory error detection method may be applied to a large-scale application and fuzz testing by maintaining unique practicality of a region-based memory while a technique capable of detecting memory errors which may not be found by the conventional region-based memory error detection technique is presented. In addition, the memory error detection method finds more memory vulnerabilities than the conventional region-based memory error detection technique in the large-scale application and fuzz testing, thereby preventing memory access errors.

Description

MEMORY ERROR DETECTION METHOD [0002]

The present invention relates to a method of detecting a memory error, and more particularly, to a method for detecting a region-based memory error applicable to a large-scale application and fuzz testing.

Memory errors are one of the most common vulnerabilities in insecure memory-intensive languages such as C and C ++. This memory error allows the attacker to cause the system to hang or to control the system. Types of memory errors include spatial memory errors and temporal memory errors. A typical example of a spatial memory error is a buffer overflow, and a typical example of a temporal memory error is a virtual pointer access. Memory error detection techniques to prevent such errors include pointer-based detection, object-based detection, and area-based detection. However, for execution and fuzz testing of large-scale applications, area-based detection techniques are used for compatibility and performance reasons.

1 is a diagram illustrating a concept of an area-based memory error detection technique.

The area-based detection method compresses and stores the accessibility of the entire virtual memory (10) address, and checks whether or not the corresponding address is accessible when accessing the memory. A memory having information for determining whether or not accessibility is possible is referred to as a shadow memory 20.

The area-based detection technique detects a spatial memory error by placing an area (hereinafter, referred to as 'red zone') 12 in which objects can not be accessed between the objects 11, When the lifetime of the object is completed, the address of the corresponding object is made into the red zone (13), making access impossible for a while. Recently compiler technologies have been developed that utilize this area-based detection technique. This area-based detection technique has practical advantages because it has high compatibility because the memory layout of the pointer does not change.

However, in the case of a memory deallocated memory, there is a risk that the object 14, which can not be written to the area, is erroneously written. That is, for example, when the virtual memory addresses 1 to 8 are the object zone 1, the virtual memory addresses 9 to 16 are the red zone, and the virtual memory addresses 17 to 24 (object zone 2) A 'is written to object area 1, virtual memory addresses 1 to 8 and object area 2, virtual memory addresses 17 to 20, when object' A ', which occupies an address size of 20, is written to object area 1 . At this time, the object 'A' written in the object area 2 is an error because the object area 2 is an area in which an object different from the object area 1 is to be written.

To prevent this, in the existing area-based memory detection technique, when the request for deallocation is received, the corresponding memory area is not deallocated but isolated, and (13) the corresponding area is used again only after the isolation space is full Respectively. However, since this method occupies actual physical memory, it is not practical.

Since the memory capacity is not infinite, the inaccessible area is not large and the address of the end of life object has to be reused. In addition, additional memory space is required for the compressed information of the red zone and accessibility.

Despite the development of these technologies, area - based memory error detection techniques have been challenged in detecting new bugs, such as those caused by recent non - linear memory accesses.

Although this problem can be solved by widening the range of the red zone, the size of the virtual memory occupied by the object or the red zone in the physical memory is the same as that occupied by the virtual memory, Due to memory limitations, it is not possible to increase the size of the red zone too much in the virtual memory, and as the size of the red zone becomes larger, the physical memory is wasted, which is not practical.

Thus, in the conventional area-based memory error detection technique, the sensing ability and the practicality are in balance. Therefore, it is very difficult to perform practical memory error detection so that it can be used for large-scale applications and fuzz testing while increasing the sensing capability.

1. Serebryany, Constantin, et al. "AddressSanitizer: A Fast Address Sanity Checker." USENIX Annual Technical Conference. 2012. 2. Microsoft Support. How to use pageheap.exe in windows xp, windows 2000, and windows server 2003. https://support.microsoft.com/en-us/kb/286470, 2009

SUMMARY OF THE INVENTION The present invention has been made to overcome the above problems, and it is an object of the present invention to develop an existing area-based memory error detection technique to provide a large red zone between objects, thereby reducing memory waste, It is an object of the present invention to provide a memory error detection method that is practically usable for fuzz testing.

According to an aspect of the present invention, there is provided a method of detecting a memory error during data access, the method comprising: (a) mapping a virtual memory page to a physical memory page; (b) setting a data access prohibition area (hereinafter referred to as " page internal red zone ") inside the virtual memory page; (c) setting a certain area after the virtual memory page to a data access prohibition area (hereinafter referred to as a page unit red zone); (d) mapping a certain area after the page unit red zone to the physical memory page as a new virtual memory page; (e) setting a page internal red zone in the virtual memory page; (f) setting a page unit red zone in a predetermined area after the virtual memory page; And (g) performing the steps (d) through (f) each time a new virtual memory page is set.

The page internal red zone setting of the step (b) and the step (e) can be performed by setting whether or not each memory address can be accessed in a shadow memory area allocated to a certain area on the memory.

The accessibility setting of each memory address may be performed by setting bit corresponding to each memory address to 0 or 1 in the shadow memory area.

The shadow memory area can be set simultaneously in the physical memory and the virtual memory.

(H) if there is the virtual memory access of the data (object), the page internal red of the data by the setting of the access prohibition on the shadow memory corresponding to the accessed memory address, And determining whether a memory error due to the zone access has occurred or not.

The page unit red zone setting in the step (c) and the step (f)

Requesting an operating system (OS) to set an access prohibited area for the page unit red zone, without setting accessibility on the shadow memory or setting accessibility on an additional memory, This can be done by setting an access prohibited zone for the red zone.

After step (c), if the access to the page-unit red zone of the data (object) is made, the signal handler may detect the access to the page unit red zone to notify that a memory error has occurred have.

In steps (a) and (d) above, the mapping of the virtual memory page to the physical memory page may be accomplished by calling the mapping function to the physical memory page of the virtual memory page provided by the system.

In the step (d), when the mapping function to the physical memory page of the virtual memory page provided by the system requests to specify the size to be deallocated to the existing virtual memory page, the size to be deallocated is set to 0 The new virtual memory page can be mapped to the physical memory page to which the existing virtual memory page is mapped while maintaining the existing virtual memory page as it is.

In the step (d), at the time of calling the mapping function to the physical memory page of the virtual memory page provided by the system, the new virtual memory page is referred to as a physical memory You can set the parameters to be mapped to the page.

According to the present invention, a technique for detecting memory errors that could not be found by the conventional area-based memory error detection technique is presented, while maintaining practicality peculiar to the area-based memory so that it can be applied to a large scale application and fuzz testing, Large-scale applications and fuzz testing have the effect of finding more memory weaknesses than traditional area-based memory error detection techniques and preventing memory access errors.

1 shows a concept of a region-based memory error detection scheme;
FIG. 2 is a diagram showing the concept of securing practicality through improved mapping of many-to-one memory pages and improved ability to detect spatial and temporal memory errors using a 64-bit memory address.
3 illustrates a method of many-to-one memory page mapping;
4 is a flowchart for performing a memory error detection method of the present invention;
5 is a graph showing execution performance of a prototype.
Figure 6 is a graph showing the fuzzing performance of the prototype.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms and words used in the present specification and claims should not be construed as limited to ordinary or dictionary terms, and the inventor should appropriately interpret the concepts of the terms appropriately It should be interpreted in accordance with the meaning and concept consistent with the technical idea of the present invention based on the principle that it can be defined. Therefore, the embodiments described in this specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention and do not represent all the technical ideas of the present invention. Therefore, It is to be understood that equivalents and modifications are possible.

FIG. 2 is a diagram illustrating a concept of ensuring practicality through improvement of a spatial and temporal memory error detection capability using a 64-bit memory address and mapping of many-to-one memory pages, and FIG. 3 is a diagram illustrating a method of a many-to-one memory page mapping.

Hereinafter, a memory error detection method of the present invention will be described with reference to FIGS. 2 and 3. FIG.

The red zone 120 occupying the large virtual memory area of FIG. 2 is used to improve spatial memory error detection capability. This red zone 120 is divided into a red zone 212 (see FIG. 3) inside the virtual memory page and a red zone 220 (see FIG. 3) by page unit. This difference is shown in detail in FIG.

An arrow 140 in FIG. 2 indicates a case where an existing use area is reused when the object is used up to the end of the virtual memory area, and then returns to the virtual memory area. In this case, if the area of the red zone 120 is very large, the reuse time of the virtual memory address is delayed as much as possible, thereby improving the detection capability of the temporal memory error during the late purging time. It is also possible to utilize a large memory address value, in one embodiment, a 64-bit memory address as much as possible to improve the temporal error memory detection capability.

In the conventional area-based memory sensing technique, when a request for deallocation is received, the corresponding memory area is not deallocated and isolated, and when the isolation space becomes full, the corresponding area is used again. However, this method is not practical because it takes up actual physical memory. If the object of FIG. 2 is deallocated, the corresponding virtual memory address is not used until all addresses are exhausted and the physical memory area can be allocated to another object.

In order to solve the problem that the size of the area occupied by the object or the red zone between the physical memory and the virtual memory is the same one-to-one, as described above, the red zone area can not be allocated largely, By mapping, physical memory is wasted and practicality is ensured. Many-to-one mapping here means that multiple pages on virtual memory are mapped to one page on physical memory. Only one object is allocated to one page of physical memory without a red zone, and a red zone occupying a large area is allocated between each object in the physical memory and each object in the virtual memory. A red zone (hereinafter referred to as a " page internal red zone ") 212 is allocated in each page 210 including an object 211 in the virtual memory, and a red zone Quot;) < / RTI > That is, the red zone exists only on the virtual address, and there is no physical memory occupied by the actual red zone. It is advantageous to eliminate the waste of the physical memory space due to the red zone by mapping pages of multiple virtual memories to one physical memory page. At this time, information that the corresponding red zone is inaccessible is compressed and stored.

As shown in (1) of FIG. 3, at first, one virtual memory page is mapped to one physical memory page. In this case, as an embodiment, mapping can be performed through the mmap system call. After that, a new virtual memory page is mapped to the existing physical memory page as shown in (2) of FIG. In this case, the mremap system call can be used as an embodiment. The mremap system call is a system call that deallocates virtual pages and provides new virtual pages. In this case, if the size is set to 0, existing virtual pages are maintained, and new virtual pages are mapped to physical memory pages such as existing virtual pages. Existing virtual pages must be pages shared by all processes. To do so, allocate it as MAP_SHARED when using the mmap system call in (1) of Fig. The existing page should be a page allocated with MAP_SHARED. The new virtual page is not mapped to the new physical page, but is mapped to the existing virtual page and the mapped physical page.

As described above, the red zone area in FIG. 3 can be divided into two. A red zone (page internal red zone) 212 inside the virtual memory page of the allocated object 211 and a red zone (page unit red zone) 220 occupying the entire virtual memory page without the object allocated.

To store inaccessible information in the shadow memory 230 for the page-by-page red zone 220, a lot of physical memory is wasted. In order to do this, it makes all the corresponding page-unit red zones inaccessible by using the virtual memory page privilege of the operating system (OS). Then, the access to the page-by-page red zone is caught by the signal handler and it can be seen that a memory error has occurred. With this technique, the size of the red zone can become very large without wasting physical memory, which greatly increases the likelihood of detecting memory access errors and prevents erroneous data writing. In other words, the operating system provides the authority of a virtual page unit. When one page is all in the red zone, the inaccessibility information is not stored separately. If access to the corresponding page is inhibited, The processor detects the corresponding access. This is a feature provided by the existing operating system and requires no additional memory space at all.

4 is a flowchart illustrating a method of detecting a memory error according to the present invention.

Based on the description with reference to FIG. 2 and FIG. 3, a method of performing the memory error detection method of the present invention will be summarized below using a flowchart.

One virtual memory page is mapped to one physical memory page (S401). As described above, such a mapping can be performed by calling a function provided by the system. As an example, a function such as 'mmap' may be called

A data inaccessible area (hereinafter referred to as " page internal red zone ") is set in the virtual memory page (S402). This page internal red zone can be implemented by setting whether or not each memory address can be accessed in a shadow memory area allocated to a certain area on the memory. An example of such a shadow memory area is shown in FIG. 1 (20), FIG. 2 (130) and FIG. 3 (230). By setting bit corresponding to each memory address to 0 or 1, A zone or an object area. Although FIG. 2 and FIG. 3 show only the virtual memory area for the sake of convenience, the shadow memory area is actually set on the physical memory and the virtual memory at the same time.

After the virtual memory page, a certain area is set as a data access prohibition area (hereinafter referred to as 'page red zone') (S403). In the page-by-page red zone, there is no object area.

When setting the page unit red zone, the access inhibition area setting for the page unit red zone is set to the operating system (OS) without setting accessibility on the shadow memory or setting accessibility on the additional memory And setting an access prohibited area for the page unit red zone of the operating system. That is, the page-by-page red zone setting does not require additional physical memory at all and prevents consumption of the physical memory.

Thereafter, a certain area after the page unit red zone is mapped to the physical memory page as a new virtual memory page (S404). The physical memory page at this time is the physical memory page mapped in step S401, and many-to-one mapping is performed between the virtual memory page and the physical memory page.

The mapping of the virtual memory page to the physical memory page may also be accomplished by calling the mapping function to the physical memory page of the virtual memory page provided by the system, which may call the mremap function as an example.

You can request that the mapping function to the physical memory page of the virtual memory page provided by the system specify the size to be unallocated for the existing virtual memory page, such as mremap. In this case, set the size to be deallocated to 0 The new virtual memory page can be mapped to the physical memory page to which the existing virtual memory page is mapped while maintaining the existing virtual memory page as it is.

In addition, at the time of the mapping function call to the physical memory page of the virtual memory page provided by the system, the new virtual memory page is mapped to the physical memory page to which the existing virtual memory page is mapped instead of the new physical memory page Can be set. For example, you can set the parameter to MAP_SHARED when calling the mmap function.

A page internal red zone is also set in the new virtual memory page (S405), which is the same as described in the above step S402.

A page unit red zone is also set in a certain area after the virtual memory page (S406), and the same is the same as that described in the above step S403.

Thereafter, the above steps S404 to S406 are performed every time a new virtual memory page is set.

If there is the virtual memory access of the data (object) after the virtual memory page mapping as described above, access to the in-page red zone access of the data by the access prohibition setting on the shadow memory corresponding to the accessed memory address If it is determined that an access to the page internal red zone is determined, it is determined that the memory error is caused and the memory access is disabled (S407).

Or if there is an access to the page-by-page red zone of the data (object) as described above, the signal handler detects the access prohibition on the shadow memory, In this case, the memory access is disabled (S408).

Fig. 5 is a graph showing the execution performance of the prototype, and Fig. 6 is a graph showing the fuzzing performance of the prototype.

Performance and memory error detection capabilities were predicted through the prototype of the present invention. As shown in FIG. 5, the performance of the conventional program is degraded by an average of 21%, and the performance of the conventional area-based memory error detection technique is degraded by about 8%. However, when purging is performed as shown in FIG. 6, the memory error detection capability per unit time is improved by an average of 68%.

10: Conventional virtual memory
11: object
12: Red zone
13: Isolated memory
14: Written part of error object
20: Shadow memory
100: virtual memory of the scheme of the present invention
110: object
120: Red Zone
130: Shadow Memory
140: Reuse virtual memory
200: Virtual memory of the scheme of the present invention
210: Mapped Virtual Memory Pages
211: object
212: Inside the page Red Zone
220: Red Zone by page
230: Shadow Memory
300: physical memory

Claims (10)

CLAIMS 1. A method for detecting a memory error during data access,
(a) mapping one virtual memory page to one physical memory page;
(b) setting a data access prohibition area (hereinafter referred to as " page internal red zone ") inside the virtual memory page;
(c) setting a certain area after the virtual memory page to a data access prohibition area (hereinafter referred to as a page unit red zone);
(d) mapping a certain area after the page unit red zone to the physical memory page as a new virtual memory page;
(e) setting a page internal red zone in the virtual memory page;
(f) setting a page unit red zone in a predetermined area after the virtual memory page; And
(g) performing the steps (d) to (f) each time a new virtual memory page is set up
≪ / RTI > The method according to claim 1,
The page internal red zone setting of the step (b) and the step (e)
By setting whether or not each memory address can be accessed in a shadow memory area allocated to a certain area on the memory
The memory error detection method comprising: The method of claim 2,
The accessibility setting of each of the memory addresses may include:
In the shadow memory area, a bit corresponding to each memory address is set to 0 or 1
The memory error detection method comprising: The method of claim 2,
Wherein the shadow memory area comprises:
Simultaneously set on physical memory and virtual memory
The memory error detection method comprising: The method of claim 2,
After the step (b)
(h) When the virtual memory access of the data (object) is made, a memory error occurs due to access to the in-page red zone of the data by setting prohibition on the shadow memory corresponding to the accessed memory address Steps to determine whether
Further comprising the steps of: The method according to claim 1,
The page unit red zone setting in the step (c) and the step (f)
Requesting an operating system (OS) to set an access prohibited area for the page unit red zone, without setting accessibility on the shadow memory or setting accessibility on an additional memory, What is done by setting the prohibited zone for the red zone
The memory error detection method comprising: The method of claim 6,
After step (c)
(i) if there is an access to the page-unit red zone of data (object), the signal handler detects this and notifies that a memory error has occurred
Further comprising the steps of: The method according to claim 1,
In steps (a) and (d) above,
The mapping of the virtual memory page to the physical memory page,
By calling a mapping function to the physical memory page of the virtual memory page provided by the system
The memory error detection method comprising: The method of claim 8,
In the step (d)
If the mapping function of the virtual memory page provided by the system to the physical memory page requests to specify the size to be deallocated to the existing virtual memory page, The new virtual memory page can be mapped to the physical memory page to which the existing virtual memory page is mapped
The memory error detection method comprising: The method of claim 9,
In the step (d)
When the mapping function is called to the physical memory page of the virtual memory page provided by the system, the new virtual memory page is mapped to the physical memory page to which the existing virtual memory page is mapped rather than the new physical memory page What parameters can be set
The memory error detection method comprising:

Images