Toward Pointer Leasing for Use-After-Free Prevention
Wataru Hashimoto

Takahiro Shinagawa

The University of Tokyohashimoto@os.ecc.u-tokyo.ac.jp

The University of Tokyo
shina@ecc.u-tokyo.ac.jp

Extended Abstract
Low-level languages such as C and C++ are stillwidely used in various system software such as web
servers and browsers. In these languages, memory management is the responsibility of programmers, leading tovarious memory-related bugs. One such bug is Use-AfterFree (UAF), which occurs when a dangling pointer, apointer that points to a freed object, is dereferenced. Thenumber of UAF bugs in real-world software is increasing
and its impact on system security is severe; UAF is ranked
7th in the 2022 Common Weakness Enumeration (CWE)
Top 25 Most Dangerous Software Weaknesses.
The challenge in UAF prevention is how to guaranteethat freed and reallocated objects are not accessed throughdangling pointers without compromising performance,comprehensiveness, and compatibility. Static approaches
address this by detecting dangling pointers through sourcecode analysis, but have difficulty in comprehensivenessdue to the characteristics of low-level languages. Dynamicapproaches include pointer invalidation [1], which detects
dangling pointers with periodic memory sweeps, one-time
allocation (OTA) [3], which allocates memory objects
only once to avoid using dangling pointers, and new
hardware [2], which exploits new processor’s memory
capabilities. However, they have problems with sweeping
overhead, additional memory space overhead, probabilistic detection, or compatibility with existing systems.
We present LeaseMalloc, a combination of a compiletime instrumentation and a runtime library to address thechallenge. The key idea of LeaseMalloc is the time-limited“leasing” of pointers to heap objects. To allow leased
pointers to be used without checking until the lease
expires, LeaseMalloc guarantees that heap objects pointed
to by leased pointers will not be reallocated during thelease period even if they are freed. When the lease
period has expired, LeaseMalloc checks the validity of
the heap object; if the object has not been freed, thelease is renewed, otherwise it is considered a UAF bug.
Leasing reduces performance overhead by removing theneed of checking until the lease expires, while checkingon lease renewal allows for comprehensive, rather thanprobabilistic, dangling pointers detection.
To achieve efficient pointer leasing while maintaining
compatibility with existing systems, we introduce twotechniques. The first is to embed lease expiration time
information in the upper bits of pointers. Since the upper
bits of pointers are not used in modern 64-bit processors,
they can be utilized to embed new information without
increasing the number of bits in pointers. In addition,

Intel, AMD, and Arm are introducing processor extensions
that ignore the upper bits of the pointer, allowing theexpectation of efficient implementation by hardware.
The second is to introduce the notion of Round as
information corresponding to the lease expiration time.
Round is a monotonically increasing counter that is
assigned to both pointers and objects. When allocating anobject, the current Round value is set to both the pointerand the object, When the object is freed, the Round valueof the object is incremented so that the Round value ofthe dangling pointer becomes smaller than the object. To
compress the number of bits by slowing the pace of Roundincrease, freed objects are accumulated until a certain
threshold is exceeded, as in the OTA technique, and theactual free is batch processed and the current Roundvalue is incremented when the threshold is exceeded. Thissuppresses memory consumption in OTA while avoiding
sweep costs in pointer invalidation.
We use LLVM’s Pass Framework to implement the instrumentation of the target application. Since LeaseMalloc
needs to interpose on almost all pointer dereferences in thetarget application, we will make several implementation
optimizations. First, to reduce the access time to the current Round value, which is accessed each time during thepointer lease expiration check, we store the Round value
in an unused register such as a debug register or an old
floating-point register. Second, since UAF bugs are more
likely to be introduced into applications than into libraries
with stable implementations, we limit our instrumentation
to applications and exclude libraries. However, there is an
option to instrument libraries as well.
In summary, LeaseMalloc reduces performance overhead by leasing pointers using the pointer upper bits andthe Round notion, provides comprehensive UAF prevention through pointer checking, and enables compatibility
through a combination of compile-time instrumentation
and run-time libraries. As a future work, we seek formore effective optimizations to reduce the overhead andcompare the performance with previous works.
Acknowledgement: This work was supported by JST,
CREST Grant Number JPMJCR22M3, Japan.

References[1] Márton Erdős et al. MineSweeper: A “Clean Sweep” for Drop-In
Use-after-Free Prevention. In Proc. ASPLOS 2022, 2022.
[2] Wesley Filardo et al. Cornucopia: Temporal safety for CHERI heaps.
In Proc. 2020 IEEE Symposium on Security and Privacy, 2020.
[3] Brian Wickman et al. Preventing Use-After-Free Attacks with Fast
Forward Allocation. In Proc. 30th USENIX Security Symposium,2022.