skip to main content
Idioma:
Primo Search
Clear Search Box
Search in: Busca Geral
Busca Avançada
Busca por Índices

Automated Use-After-Free Detection and Exploit Mitigation: How Far Have We Gone?

Gui, Binfa ; Song, Wei ; Xiong, Hailong ; Huang, Jeff

Software Engineering, IEEE Transactions on, 2022, Vol.48, p.4569-4589

IEEE

Sem texto completo

Citações Citado por
  • Título:
    Automated Use-After-Free Detection and Exploit Mitigation: How Far Have We Gone?
  • Autor: Gui, Binfa ; Song, Wei ; Xiong, Hailong ; Huang, Jeff
  • Assuntos: Detectors ; exploit mitigation ; Instruments ; Performance analysis ; program analysis ; Runtime ; Static analysis ; survey ; Use-After-Free ; vulnerability detection
  • É parte de: Software Engineering, IEEE Transactions on, 2022, Vol.48, p.4569-4589
  • Descrição: C/C++ programs frequently encounter memory errors, such as Use-After-Free (UAF), buffer overflow, and integer overflow. Among these memory errors, UAF vulnerabilities are increasingly being exploited by attackers to disrupt critical software systems, leading to serious consequences, such as remote code execution and data breaches. Researchers have proposed dozens of approaches to detect UAFs in testing environments and to mitigate UAF exploit in production environments. However, to the best of our knowledge, no comprehensive studies have evaluated and compared these approaches. In this paper, we shed light on the current UAF detection and exploit mitigation approaches and provide a systematic overview, comprehensive comparison, and evaluation. Specifically, we evaluate the effectiveness and efficiency of publicly available UAF detection and exploit mitigation tools. The experimental results show that static UAF detectors are suitable for detecting intra-procedural UAFs but are not sufficient to detect inter-procedural UAFs in real-world programs. Dynamic UAF detectors are still the first choice for detecting inter-procedural UAFs. Our evaluation also demonstrates that the runtime overhead of existing UAF exploit mitigation tools is relatively stable whereas the memory overhead may vary dramatically with respect to different programs. Finally, we envision potential valuable future research directions.
  • Editor: IEEE
  • Idioma: Inglês
Voltar para lista de resultados

  • Realização: ABCD-USP USP   Logos de Redes Sociais: Freepik

Buscando em bases de dados remotas. Favor aguardar.