Source: https://patents.google.com/patent/US10191791B2/en
Timestamp: 2020-02-17 06:39:26
Document Index: 38297790

Matched Legal Cases: ['art 400', 'art 400', 'art 402', 'art 500', 'art 500', 'art 502']

US10191791B2 - Enhanced address space layout randomization - Google Patents
Enhanced address space layout randomization Download PDF
US10191791B2
US10191791B2 US15/201,443 US201615201443A US10191791B2 US 10191791 B2 US10191791 B2 US 10191791B2 US 201615201443 A US201615201443 A US 201615201443A US 10191791 B2 US10191791 B2 US 10191791B2
US15/201,443
US20180004445A1 (en
2016-07-02 Application filed by Intel Corp filed Critical Intel Corp
2016-07-02 Priority to US15/201,443 priority Critical patent/US10191791B2/en
2016-07-06 Assigned to INTEL CORPORATION reassignment INTEL CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: GABOR, RON, NUZMAN, Joseph, STARK, TOMER
2018-01-04 Publication of US20180004445A1 publication Critical patent/US20180004445A1/en
2019-01-29 Publication of US10191791B2 publication Critical patent/US10191791B2/en
The present disclosure relates to address space layout randomization, in particular to, enhanced address space layout randomization.
Address space layout randomization (ASLR) is a mechanism to improve software security. ASLR is configured to make it more difficult for an attacker to predict target addresses. For example, in order to execute a return-to-libc attack, code to be executed must be located prior to the attack. In another example, the stack must be located in attacks configured to inject shell code on the stack. Thus, for an attack to be successful, an attacker must determine where the code and/or stack is located.
Without ASLR, each library, stack and/or heap may be placed at a respective same address whenever they are launched, allowing an attacker to “learn” and thus to predict a likely address. With ASLR, rather than consistently arranging address space positions of an application, stack, heap and/or library, the respective address space positions are randomized each time memory is allocated for the application, stack, heap and/or library. Effectiveness of the randomization is related to a size of the linear address space.
FIG. 1 illustrates a functional block diagram of a system consistent with several embodiments of the present disclosure;
FIG. 2 is an example illustrating a metadata data structure consistent with several embodiments of the present disclosure;
FIG. 3 illustrates memory object distribution using enhanced address space layout randomization, consistent with one embodiment of the present disclosure;
FIG. 4 is a flowchart of enhanced address space layout randomization operations according to various embodiments of the present disclosure; and
FIG. 5 is a flowchart of memory corruption detection operations according to various embodiments of the present disclosure.
ASLR is configured to reduce a likelihood of an attacker determining a location of a memory object based, at least in part, on knowledge of a prior location of the memory object. Effectiveness of ASLR may be improved by increasing entropy, e.g., increasing a size of a search space. Thus, entropy may be increased, for example, by increasing a size of a linear (i.e., virtual) address space. Linear memory (and linear address space) correspond to virtual memory, an abstraction configured to facilitate utilizing physical memory and/or storage by one or more applications. The size of the linear address space is related to a size in bits of linear addresses associated with the linear address space. The number of linear address bits and, thus, a size of the linear address space, may be constrained by processor configuration, instruction set architecture (ISA) and/or operating system (OS) characteristics.
An address pointer, i.e., a pointer to a linear address, may include more bits than are actually used for addressing linear memory. For example, an address pointer may include 64 bits and a linear address may include 48 bits. In other words, although the address pointer includes 64 bits, processor circuitry, address bus, etc., may be configured to accommodate 48 bits. Higher order bits, e.g., bits 48 through 63 of the address pointer may generally be “canonical”, meaning the higher order bits may be set equal to the value of bit 47.
A linear address space is generally configured to include a user portion and a portion reserved for the operating system (“OS portion”). For a 48-bit linear address, in most cases, the most significant linear address bit, i.e., bit 47, equal to zero corresponds to the user portion and bit 47 equal to one corresponds to the OS portion. Thus, the user portion of the linear address space may include 128 terabytes (TB) and the OS portion of the linear address space may include 128 TB of memory.
The following describes a 64-bit address pointer and a 48-bit linear address. Address pointers and linear addresses of other bit lengths may be used, within the scope of the present disclosure.
Generally, this disclosure relates to enhanced address space layout randomization (ASLR). An apparatus, method and/or system are configured to utilize one or more higher order bits in an address pointer to provide enhanced ASLR, i.e., an illusion of ASLR over an apparent address space that is greater in size than the user portion of the linear address space. The apparent address space includes the user linear address space plus at least a portion of a “non-canonical hole”. The non-canonical hole corresponds to address pointers with one or more higher order bits that are not equal to the value of bit 47. At least a portion of the higher order bits may be set to a metadata value that may then be used to enhance ASLR, as will be described in more detail below.
Utilizing the higher order bits in the address pointer is configured to enhance ASLR by increasing entropy. In other words, although an application, a stack, a heap and one or more libraries are actually stored in user memory in linear memory objects, associated linear addresses may be enhanced by metadata values associated with higher order address bits in a corresponding address pointer. The metadata values may then be randomized alternatively with, and/or in addition, to randomizing the associated linear addresses. The apparent (“enhanced”) memory addresses may then be spread over an enhanced address space that is larger than the linear address space. For example, for a 6 bit metadata value, a size of the apparent memory address space is 64 times a size of the linear address space. Thus, entropy is increased.
Metadata values may be stored in a metadata data structure configured to associate one or more metadata values with one or more linear addresses, and thus memory objects. The metadata data structure may be allocated in linear memory and a metadata base pointer that points to a base address of the metadata data structure may be stored in, e.g., a processor register. The metadata data structure may include one or more levels. For example a two-level metadata data structure may include a metadata directory and one or more metadata tables, as will be described in more detail below.
One or more of bits of a linear address may be utilized as an index (i.e., a linear address pointer) into the metadata data structure. The index may then point to the metadata value to be included in the higher order bits of an associated address pointer provided to, e.g., an application. The bit position in the linear address of the index may be related to a size of a memory object that is associated with the corresponding metadata value.
Allocating the metadata data structure in linear memory is configured to facilitate updating metadata values in the enhanced linear addresses by updating metadata values in the metadata data structure and/or updating metadata table pointers. The updated metadata value may then be provided to an application by providing an updated address pointer that includes the updated metadata value. In other words, changing the metadata value in the address pointer corresponds to an apparent change in storage location of a corresponding memory object.
Upon a memory access, e.g., a load, a store and/or instruction fetch operation, the metadata value included in the address pointer may be compared to the metadata value stored in the metadata data structure that is pointed to by the linear address pointer. If the metadata values do not match, then a fault may be generated. If the metadata values match then the metadata values may be stripped off and the linear address may be used to execute the memory access operation. Thus, the metadata value may be utilized for memory corruption detection.
Thus, entropy associated with ASLR may be increased for a system without increasing the size of linear addresses. The metadata values may be further utilized during memory access operations to detect memory corruption. Memory corruption may be caused, for example, by an out-of-bound access (e.g., memory access using the base address of a memory buffer and an offset that exceeds the allocated size of the buffer) or by a dangling pointer (i.e., a pointer which referenced a memory buffer that has been de-allocated).
FIG. 1 illustrates a functional block diagram of a system 100 consistent with several embodiments of the present disclosure. System 100 may include, but is not limited to, a mobile telephone including, but not limited to a smart phone (e.g., iPhone®, Android®-based phone, Blackberry®, Symbian®-based phone, Palm®-based phone, etc.); a wearable device (e.g., wearable computer, “smart” watches, smart glasses, smart clothing, etc.) and/or system; an Internet of Things (IoT) networked device including, but not limited to, a sensor system (e.g., environmental, position, motion, etc.) and/or a sensor network (wired and/or wireless); a computing system (e.g., a server, a workstation computer, a desktop computer, a laptop computer, a tablet computer (e.g., iPad®, GalaxyTab® and the like), an ultraportable computer, an ultramobile computer, a netbook computer and/or a subnotebook computer; etc.
System 100 may include a processor 102, a memory 104, a communication interface “Comm” 106, storage 108 and/or a user interface (UI) 110. Communication interface 106 is configured to provide communication capability, wired and/or wireless, to system 100. Storage 108 may include internal and/or external storage devices including, but not limited to, hard disk drives, solid-state storage devices, etc. User interface 110 may include, but is not limited to, a user input device (e.g., keyboard, a keypad, touchpad, mouse, microphone, etc.), a display (including a touch sensitive display), etc.
Processor 102 may include one or more processing units, e.g., processing unit 120, a cache memory 122 and one or more processor registers 124. Processor 102 may include MCD (memory corruption detection) logic 126. Memory 104 may include an operating system (OS) 130, one or more applications, e.g., application 132, and metadata data structure 134. Memory 104 may further include enhanced ASLR logic 138.
System 100 may include metadata logic 140 and/or 142. For example, metadata logic 140 may be implemented in circuitry. In another example, metadata logic 142 may be implemented in logic and may be stored in memory 104. For example, the metadata logic 140 and/or 142 may correspond to random number generators (RNGs) configured to generate random or pseudorandom numbers. A number of bits in each random number may correspond to a size of a corresponding metadata value.
Processor registers 124 may be configured to store MCD configuration data 125 and a metadata base pointer 127. The MCD configuration data 125 may be set, for example, by a user. MCD configuration data 125 may include, but is not limited to, an enable/disable bit, a metadata position indicator, a metadata size and/or one or more metadata data structure parameters. The enable/disable bit is configured to enable or disable enhanced ASLR, as described herein. The metadata position indicator is configured to contain a bit position value of a least significant bit of the metadata value included in an address pointer. The bit position may be correspond to the upper (i.e., “higher order”) bits. For example, the bit position may be greater than or equal to bit position 48 and less than bit position 63. The metadata size is configured to contain a size in bits of a metadata value. For example, the metadata size may be in the range of zero to fifteen to bits. A relatively larger metadata size may correspond to a relatively higher entropy.
Metadata data structure parameters may include, but are not limited to, a type indicator, a number of linear address bits to index into a metadata directory, a number of linear address bits to index into a metadata table. The type indicator is configured to indicate a number of levels, e.g., one or two, in the metadata data structure. The number of linear address bits correspond to a size of a memory object that is associated with a particular metadata value.
OS 130 may be configured to set a metadata base pointer in processor registers 124, e.g., metadata base pointer 127, if enhanced ASLR is enabled. For example, the metadata base pointer 127 may be set in response to receiving an application launch request. The metadata base pointer is configured to point to a base address (linear address) of the metadata data structure 134. Metadata data structure 134 may then be allocated utilizing the metadata base pointer 127. For example, OS 130 and/or application 132 may allocate a memory portion configured to store metadata data structure 134. The metadata data structure 134 is configured to be stored in linear memory at a base linear address pointed to by metadata base pointer 127.
FIG. 2 is an example 200 illustrating a metadata data structure 202 consistent with several embodiments of the present disclosure. Example 200 further illustrates a metadata base pointer 208 and an address pointer 210. Metadata data structure 202 is one example of metadata data structure 134 of FIG. 1. Address pointer 210 includes a plurality of address pointer fields 212, 214, 216, 218, 220. Address pointer 210 corresponds to an enhanced ASLR linear address, enhanced by address field 218 configured to contain a metadata value. Address fields 212, 214 and 216 correspond to a linear address 211. The enhanced linear address 210 corresponds to an apparent address space that is larger than the actual linear address space that may be addressed by linear address 211.
A least significant address field 212 includes a least significant bit (LSB) of address pointer 210 (and linear address 211). A most significant address field 220 includes a most significant bit (MSB) of address pointer 210. In this example 200, address field 218 may be configured to include a metadata value. For a 48-bit linear address 211 and a 64-bit address pointer 210, address field 218 may include up to 15 bits. For example, address field 218 may include six bits. In another example, address field 218 may include more than or fewer than six bits.
In one example, the least significant address field 212 may include six bits configured to address a 64-byte data block. In another example, the least significant address field 212 may include more or fewer bits configured to address a larger or smaller data block. The most significant address field 220 may include at least one bit. A number of bits included in the most significant address field 220 is related to the number of bits included in address field 218 and corresponding metadata value. For user address space, the most significant bit (MSB) of the most significant address field 220 is equal to zero in most cases.
A base address of metadata data structure 202 may be pointed to by metadata base pointer 208. Metadata base pointer 208 is one example of metadata base pointer 127 of FIG. 1. Linear address fields 214, 216 may be configured as indexes into metadata data structure 202. In other words, linear address fields 214, 216 may be configured to point to one or more metadata values stored in metadata data structure 202. Address fields 214 and 216 may each include a respective plurality of bits. A size of each address field 214, 216 is related to a configuration of metadata data structure 202.
The metadata data structure 202 may be configured as a two level or a one level data structure. The number of levels is related to enhanced ASLR granularity, i.e., a size of a memory object associated with a metadata value. A two level metadata data structure may include a metadata directory and one or more metadata tables. A one level metadata data structure may include the metadata directory.
In an embodiment, metadata data structure 202 may be configured as a two level data structure including metadata directory 204 and at least one metadata table, e.g., metadata table 206. A size of linear address field 216 may be related to a size of metadata directory 204. Metadata directory 204 may contain one or more metadata table pointers, e.g., metadata table pointer 230. Address field 216 may be utilized as an index into the metadata directory 204 and may point to a metadata table pointer, e.g., metadata table pointer 230. Each metadata table pointer, e.g., metadata table pointer 230, may point to a base address of a metadata table, e.g., metadata table 206. The linear address field 214 may then be utilized as an index, e.g., offset, into metadata table 206 and may point to a metadata value, e.g., metadata value 232. Each group of linear addresses with linear address bits corresponding to address field 214 may have a same metadata value in enhanced address field 218.
In another embodiment, metadata data structure 202 may not include metadata table 206. Thus, the metadata data structure 202 of this embodiment may be a one level metadata data structure. Metadata directory 204 may then be configured to store a plurality of metadata values, e.g., metadata value 234. Linear address field 216 may be utilized as an index into metadata directory 204. For example, linear address field 216 may point to metadata value 234. Each group of linear addresses with linear address bits corresponding to address field 216 may then have a same metadata value in enhanced address field 218.
Thus, metadata data structure 202 may be configured to provide a variety of granularities, i.e., memory object sizes, that are associated with a selected metadata value. Including metadata data structure 202 in linear memory is configured to facilitate determining and updating metadata values and randomizing enhanced linear addresses. In other words, an apparent linear address of a memory object may be changed by changing a corresponding metadata value.
Turning again to FIG. 1, in response to receiving the request to launch an application, e.g., application 132, OS 130 may allocate the metadata data structure 134. For example, the OS may set the metadata base pointer 127 that points to the metadata data structure 134, as described herein. The metadata base pointer 127 may be stored to processor registers 124, as described herein. The OS 130 may then allocate the metadata data structure 134. The type of metadata data structure may be determined based, at least in part, on the MCD configuration data 125.
A memory object configured to store at least a portion of the application 132 may then be allocated by, e.g., OS 130. The OS 130 may determine a linear address associated with the memory object. For example, the linear address may correspond to a base address of the memory object. The memory object may be configured to contain application code and/or data, a heap and/or library associated with application 132. The memory object may be allocated in memory 104 in linear address space.
A metadata value may then be generated. For example, enhanced ASLR logic 138 may be configured to trigger metadata logic 140, 142 to generate the metadata value in response to the launch of an application. Enhanced ASLR logic 138 may be configured to read MCD configuration data 125 from processor registers 124 to determine a number of bits in a metadata value. Enhanced ASLR logic 138 may then configure metadata logic 140 to provide a metadata value of a corresponding size, i.e., number of bits.
Enhanced ASLR logic 138 may then retrieve the metadata value from the metadata logic 140, 142. Enhanced ASLR logic 138 may be configured to determine a metadata position in the address pointer based, at least in part, on the MCD configuration data 125. The retrieved metadata value may be associated with the application 132. The metadata value may then be combined with the linear address into a corresponding address pointer. Enhanced ASLR logic 138 may be configured to combine the metadata value and the linear address into the address pointer at the bit position defined by MCD configuration data 125.
The metadata value may then be stored to metadata data structure 134 at a location pointed to by at least a portion of the linear address, as described herein. The at least a portion of the linear address may be determined by, e.g., enhanced ASLR logic 138, based, at least in part, on metadata data structure parameters included in the MCD configuration data 125. For example, the metadata data structure parameters may include a number of linear address bits to index into a metadata directory and/or a number of linear address bits to index into a metadata table. Enhanced ASLR logic 138 may be configured to store the metadata value to the metadata data structure at a location pointed to by at least a portion of the linear address. The address pointer may then be returned and the application may launch. Thus, an address pointer associated with the allocated memory object may be generated and may include a metadata value in higher order bits.
After the application 132 has been launched, the application 132 may allocate additional memory objects configured to store, for example, a heap, a library, etc. Operations to generate, retrieve and store a metadata value and to combine the metadata value with a linear address of the allocated memory object, as described herein, may be repeated for each allocated memory object. The memory objects may be associated with, e.g., a heap and/or library. The memory objects may be allocated and a corresponding address pointer (i.e., enhanced linear address) may be generated in response to a memory allocation request by an application and/or a library. The address pointer may then be returned to the requesting application and/or library.
Thus, the OS 130, an application 132 and/or a library may manipulate metadata data structure 134. Additional metadata values may be generated and stored to metadata data structure 134 at locations pointed to by at least a portion of one or more linear addresses of allocated memory objects. The metadata values may be combined with corresponding linear addresses into corresponding address pointers. The corresponding address pointers may then be returned to the application.
Thus, each time a memory object is allocated, an associated address pointer may include a randomly generated metadata value configured to span at least a portion of the non-canonical hole, as described herein. The address pointer corresponds to an apparent address in an enhanced address space. A size of the enhanced address space is greater than a size of the linear address space.
In operation, an application, e.g., application 132, may request a memory access, e.g., a load, a store or an instruction fetch operation. The memory access request may include the address pointer provided to the application, as described herein. In response to the memory access request, the metadata value may be stripped off the address pointer by, e.g., MCD logic 126. The corresponding linear address may then be used to perform the memory access operation. Thus, while the apparent address space may be addressable by a 64-bit enhanced linear address, 48-bit linear addressing of the actual linear address space, may be preserved.
FIG. 3 illustrates memory object distribution 300 using enhanced address space layout randomization, consistent with one embodiment of the present disclosure. Memory object distribution 300 includes an actual memory structure 302 and an enhanced memory structure 304. Actual memory structure 302 includes a linear address space 310, a first non-canonical hole 312, a second non-canonical hole 316 and a reserved OS region 314. For example, for a 48-bit linear address, linear address space 310 may include 128 TB (terabytes) of user address space and 128 TB of reserved address space. The non-canonical holes 312, 316 correspond to 64-bit address pointers where bits 48 through 62 are not all zeros or all ones. The first non-canonical hole 312 corresponds to a 64-bit address pointer where the most significant bit is zero. The second non-canonical hole 316 corresponds to a 64-bit address pointer where the most significant bit is one.
Enhanced memory structure 304 illustrates actual and apparent randomized distribution of a plurality of memory objects. Enhanced memory structure 304 includes linear address space 310 and the first non-canonical hole 312. Enhanced memory structure 304 illustrates an actual distribution of memory objects, e.g., linear memory objects 320, 322, 324, 326, 328. Enhanced memory structure 304 further illustrates an apparent distribution of memory objects, e.g., enhanced memory objects 321, 323, 325, 327. For example, linear memory object 320 may correspond to a first heap, linear memory object 322 may correspond to a second heap, linear memory object 324 may correspond to an application code, linear memory object 326 may correspond to a first library and linear memory object 328 may correspond to a second library. Continuing with this example, enhanced memory object 321 may also correspond to the first heap 320, enhanced memory object 323 may correspond to the second heap 322, enhanced memory object 325 may correspond to the application code 324 and enhanced memory object 327 may correspond to the first library 326. In this example, an enhanced linear address (i.e., address pointer) and an actual linear address of linear memory object 328 may be the same. In other words, the metadata value associated with linear memory object 328 may be zero.
Thus, the apparent memory object distribution is over an apparent address space of a size greater than 128 TB of linear address space 310. For example, for a 6 bit metadata value, the apparent address space 304 may include 64×128 TB, i.e., 8192 TB. The distribution of memory objects may change each time a memory object is allocated.
The metadata may be utilized to provide memory corruption detection in addition to and/or alternatively with enhanced ASLR. In response to receiving a memory access request, the metadata value included in the address pointer associated with the memory access request may be compared to the metadata value included in the metadata data structure pointed to by the at least a portion of the linear address. If the two metadata values are the same, the memory access may be allowed. If the two metadata values are not the same, a fault may be generated.
For example, MCD logic 126 included in processor 102 may be configured to compare a metadata value included in an address pointer received from an application to a corresponding metadata value stored in a metadata data structure and pointed to by corresponding linear address bits. If the metadata values match, then the MCD logic 126 may strip off the higher order bits included in, e.g., address field 218 of FIG. 2. The remaining linear address may then be utilized to access linear address space. If the metadata values do not match, a fault may be generated by MCD logic 126 and the linear address space may not be accessed. Thus, the metadata values may be utilized for enhanced ASLR and/or memory corruption detection.
FIG. 4 is a flowchart 400 of enhanced address space layout randomization operations according to various embodiments of the present disclosure. In particular, the flowchart 400 illustrates enhanced address space layout randomization utilizing metadata. The operations may be performed, for example, by OS 130, application 132 and/or enhanced ASLR logic 138 of FIG. 1.
Operations of this embodiment may begin with start 402. An application launch request may be received at operation 404. A metadata data structure base pointer may be set at operation 406. A metadata data structure may be allocated at operation 408. Operation 410 includes allocating a memory object. A linear address may correspond to a base address of the memory object. Operation 412 includes generating a metadata value. The metadata value may be stored to the metadata data structure at operation 414. The metadata value may be combined with the linear address to generate an address pointer at operation 415. The address pointer to the memory object may be returned at operation 416. The application may then be launched or continued at operation 418. A memory allocation request may be received at operation 420. For example, the memory allocation request may be received from the launched application. In some embodiments, operations 410, 412, 414, 416 may be repeated at operation 422. For example, prior to application launch, OS 130 may perform operations 410, 412, 414, 416. After application launch, the application and/or the OS may perform operations 410 through 416, for example, in response to a memory allocation request. Program flow may then continue at operation 424.
Thus, a metadata data structure may be allocated and a plurality of metadata values may generated. A metadata value may be combined with a linear address associated with a memory portion, e.g., memory object, into an address pointer. A plurality of address pointers may thus provide an apparent distribution of memory objects over an enhanced address space that is larger than the linear address space.
FIG. 5 is a flowchart 500 of memory corruption detection operations according to various embodiments of the present disclosure. In particular, the flowchart 500 illustrates memory corruption detection utilizing metadata values in a metadata data structure and corresponding metadata values included in the upper bits of an address pointer. The operations may be performed, for example, by OS 130 and/or MCD logic 126 of FIG. 1.
Operations of this embodiment may begin with start 502. A memory access request including a target address pointer that includes a target metadata value and a target linear address may be received at operation 504. The target metadata value may be compared to a metadata value stored in the metadata data structure and pointed to by at least a portion of the target linear address at operation 506. Whether the target metadata value and the stored metadata value are the same may be determined at operation 508. If the metadata values are the same, the target metadata value may be stripped off the address pointer at operation 514. Memory access may be allowed using the target linear address at operation 516. Program flow may continue in operation 518. If the metadata values are not the same, a fault may be generated at operation 510. Program flow may then end at operation 512.
Thus, memory corruption may be detected utilizing target metadata values included address pointers and metadata values stored in metadata data structure 134. Thus, the metadata values may be utilized for enhanced ASLR and/or memory corruption detection.
While the flowcharts of FIGS. 4 through 5 illustrate operations according various embodiments, it is to be understood that not all of the operations depicted in FIGS. 4 through 5 are necessary for other embodiments. In addition, it is fully contemplated herein that in other embodiments of the present disclosure, the operations depicted in FIGS. 4 and/or 5 and/or other operations described herein may be combined in a manner not specifically shown in any of the drawings, and such embodiments may include less or more operations than are illustrated in FIGS. 4 through 5. Thus, claims directed to features and/or operations that are not exactly shown in one drawing are deemed within the scope and content of the present disclosure.
Thus, an apparatus, method and/or system are configured to utilize one or more higher order bits in an address pointer to enhance ASLR over an apparent address space that is greater in size than the user portion of the linear address space. Although an application, a stack, a heap and one or more libraries are actually stored in user memory in linear memory objects, associated linear addresses may be enhanced by metadata values in higher order address bits in a corresponding address pointer. Each metadata value may then be randomized alternatively with, and/or in addition, to randomizing an associated linear address.
Metadata values may be stored in a metadata data structure configured to associate one or more metadata values with one or more linear addresses, and thus memory objects. The metadata data structure may be allocated in linear memory and a metadata base pointer that points to a base address of the metadata data structure may be stored in, e.g., a processor register. The metadata data structure may include one or more levels.
Thus, entropy associated with ASLR may be increased for a system without increasing the size of linear addresses. The metadata values may be utilized during memory access operations to detect memory corruption and/or to support enhanced ASLR, as described herein.
The operating system (OS) 130 may be configured to manage system resources and control tasks that are run on, e.g., system 100. For example, the OS may be implemented using Microsoft® Windows®, HP-UX®, Linux®, or UNIX®, although other operating systems may be used. In another example, the OS may be implemented using Android™, iOS, Windows Phone® or BlackBerry®. In some embodiments, the OS may be replaced by a virtual machine monitor (or hypervisor) which may provide a layer of abstraction for underlying hardware to various operating systems (virtual machines) running on one or more processing units.
Memory 104 may include one or more of the following types of memory: semiconductor firmware memory, programmable memory, non-volatile memory, read only memory, electrically programmable memory, random access memory, flash memory, magnetic disk memory, and/or optical disk memory. Either additionally or alternatively system memory may include other and/or later-developed types of computer-readable memory.
Examples of the present disclosure include subject material such as a method, means for performing acts of the method, a device, or of an apparatus or system related to enhanced address space layout randomization, as discussed below.
According to this example, there is provide an apparatus. The apparatus includes a linear address space, metadata logic and enhanced address space layout randomization (ASLR) logic. The linear address space includes a metadata data structure. The metadata logic is to generate a metadata value. The enhanced ASLR logic is to combine the metadata value and a linear address into an address pointer and to store the metadata value to the metadata data structure at a location pointed to by a least a portion of the linear address. The address pointer corresponds to an apparent address in an enhanced address space. A size of the enhanced address space is greater than a size of the linear address space.
This example includes the elements of example 1, and further includes memory corruption detection (MCD) logic to compare a target metadata value in a target address pointer including the linear address to the metadata value stored to the metadata data structure and to generate a fault if the target metadata value and the stored metadata value are not the same.
This example includes the elements of example 1, wherein the metadata data structure is two level.
This example includes the elements of example 1, wherein the metadata value is included in one or more upper bits of the address pointer.
This example includes the elements according to any one of examples 1 through 4, wherein the metadata value is a random number.
This example includes the elements according to any one of examples 1 through 4, wherein the linear address includes 48 bits and the address pointer includes 64 bits.
This example includes the elements according to any one of examples 1 through 4, wherein the metadata data structure includes a metadata directory and a metadata table.
According to this example, there is provided a method. The method includes generating, by metadata logic, a metadata value; combining, by enhanced address space layout randomization (ASLR) logic, the metadata value and a linear address into an address pointer; and storing, by the enhanced ASLR logic, the metadata value to a metadata data structure at a location pointed to by a least a portion of the linear address. The metadata data structure is included in a linear address space. The address pointer corresponds to an apparent address in an enhanced address space. A size of the enhanced address space is greater than a size of the linear address space.
This example includes the elements of example 8, and further includes comparing, by memory corruption detection (MCD) logic, a target metadata value in a target address pointer including the linear address to the metadata value stored to the metadata data structure; and generating, by the MCD logic, a fault if the target metadata value and the stored metadata value are not the same.
This example includes the elements of example 8, wherein the metadata data structure is two level.
This example includes the elements of example 8, wherein the metadata value is included in one or more upper bits of the address pointer.
This example includes the elements of example 8, wherein the metadata value is a random number.
This example includes the elements of example 8, wherein the linear address includes 48 bits and the address pointer includes 64 bits.
This example includes the elements of example 8, wherein the metadata data structure includes a metadata directory and a metadata table.
According to this example, there is provided a system. The system includes a processor, a linear address space, metadata logic and enhanced address space layout randomization (ASLR) logic. The processor includes at least one processor register. The linear address space includes a metadata data structure. The metadata logic is to generate a metadata value. The enhanced ASLR logic is to combine the metadata value and a linear address into an address pointer and to store the metadata value to the metadata data structure at a location pointed to by a least a portion of the linear address. The address pointer corresponds to an apparent address in an enhanced address space. A size of the enhanced address space is greater than a size of the linear address space.
This example includes the elements of example 15, and further includes memory corruption detection (MCD) logic to compare a target metadata value in a target address pointer including the linear address to the metadata value stored to the metadata data structure and to generate a fault if the target metadata value and the stored metadata value are not the same.
This example includes the elements of example 15, wherein the metadata data structure is two level.
This example includes the elements of example 15, wherein the metadata value is included in one or more upper bits of the address pointer.
This example includes the elements according to any one of examples 15 through 18, wherein the metadata value is a random number.
This example includes the elements according to any one of examples 15 through 18, wherein the linear address includes 48 bits and the address pointer includes 64 bits.
This example includes the elements according to any one of examples 15 through 18, wherein the metadata data structure includes a metadata directory and a metadata table.
This example includes the elements according to any one of examples 15 through 18, wherein the at least one processor register is to store a metadata base pointer.
This example includes the elements according to any one of examples 15 through 18, wherein the at least one processor register is to store memory corruption (MCD) configuration data.
This example includes the elements of example 23, wherein the MCD configuration data includes one or more of an enable/disable bit, a metadata position indicator, a metadata size and/or one or more metadata data structure parameters.
This example includes the elements of example 24, wherein the metadata data structure parameter is selected from the group including one of more of a type indicator, a number of linear address bits to index into a metadata directory, a number of linear address bits to index into a metadata table.
According to this example, there is provided a computer readable storage device. The device has stored thereon instructions that when executed by one or more processors result in the following operations including: generating a metadata value; combining the metadata value and a linear address into an address pointer; and storing the metadata value to a metadata data structure at a location pointed to by a least a portion of the linear address. The metadata data structure is included in a linear address space. The address pointer corresponds to an apparent address in an enhanced address space. A size of the enhanced address space is greater than a size of the linear address space.
This example includes the elements of example 26, wherein the instructions that when executed by one or more processors results in the following additional operations including comparing a target metadata value in a target address pointer including the linear address to the metadata value stored to the metadata data structure; and generating a fault if the target metadata value and the stored metadata value are not the same.
This example includes the elements of example 26, wherein the metadata data structure is two level.
This example includes the elements of example 26, wherein the metadata value is included in one or more upper bits of the address pointer.
This example includes the elements according to any one of examples 26 through 29, wherein the metadata value is a random number.
This example includes the elements according to any one of examples 26 through 29, wherein the linear address includes 48 bits and the address pointer includes 64 bits.
This example includes the elements according to any one of examples 26 through 29, wherein the metadata data structure includes a metadata directory and a metadata table.
According to this example, there is provided a device. The device includes means for generating, by metadata logic, a metadata value; means for combining, by enhanced address space layout randomization (ASLR) logic, the metadata value and a linear address into an address pointer; and means for storing, by the enhanced ASLR logic, the metadata value to a metadata data structure at a location pointed to by a least a portion of the linear address. The metadata data structure id included in a linear address space. The address pointer corresponds to an apparent address in an enhanced address space. A size of the enhanced address space is greater than a size of the linear address space.
This example includes the elements of example 33, and further includes means for comparing, by memory corruption detection (MCD) logic, a target metadata value in a target address pointer including the linear address to the metadata value stored to the metadata data structure; and means for generating, by the MCD logic, a fault if the target metadata value and the stored metadata value are not the same.
This example includes the elements of example 33, wherein the metadata data structure is two level.
This example includes the elements of example 33, wherein the metadata value is included in one or more upper bits of the address pointer.
This example includes the elements according to any one of examples 33 through 36, wherein the metadata value is a random number.
This example includes the elements according to any one of examples 33 through 36, wherein the linear address includes 48 bits and the address pointer includes 64 bits.
This example includes the elements according to any one of examples 33 through 36, wherein the metadata data structure includes a metadata directory and a metadata table.
According to this example, there is provided a system. The system includes at least one device arranged to perform the method of any one of examples 8 to 14.
According to this example, there is provided a device. The device includes means to perform the method of any one of examples 8 to 14.
According to this example, there is provided a computer readable storage device. The device has stored thereon instructions that when executed by one or more processors result in the following operations including: the method according to any one of examples 8 through 14.
1. An enhanced address space layout randomization apparatus comprising:
a linear address space comprising a metadata data structure;
metadata logic to generate a metadata value; and
enhanced address space layout randomization (ASLR) logic to combine the metadata value and a linear address into an address pointer and to store the metadata value to the metadata data structure at a location pointed to by a least a portion of the linear address,
the address pointer corresponding to an apparent address in an enhanced address space, a size of the enhanced address space greater than a size of the linear address space.
3. The apparatus of claim 1, wherein the metadata data structure is a two level data structure.
8. An enhanced address space layout randomization method comprising:
generating, by metadata logic, a metadata value;
combining, by enhanced address space layout randomization (ASLR) logic, the metadata value and a linear address into an address pointer; and
storing, by the enhanced ASLR logic, the metadata value to a metadata data structure at a location pointed to by a least a portion of the linear address,
the metadata data structure being included in a linear address space, the address pointer corresponding to an apparent address in an enhanced address space having a size that is greater than a size of the linear address space.
9. The method of claim 8, further comprising comparing, by memory corruption detection (MCD) logic, a target metadata value in a target address pointer comprising the linear address to the metadata value stored to the metadata data structure; and generating, by the MCD logic, a fault if the target metadata value and the stored metadata value do not match.
10. The method of claim 8, wherein the metadata data structure is a two level data structure.
15. An enhanced address space layout randomization system comprising:
a processor comprising at least one processor register;
16. The system of claim 15, further comprising memory corruption detection (MCD) logic to compare a target metadata value in a target address pointer comprising the linear address to the metadata value stored to the metadata data structure and to generate a fault if the target metadata value and the stored metadata value do not match.
17. The system of claim 15, wherein the metadata data structure is a two level data structure.
23. A computer readable storage device having stored thereon instructions that when executed by one or more processors result in the following operations comprising:
generating a metadata value;
combining the metadata value and a linear address into an address pointer; and
storing the metadata value to a metadata data structure at a location pointed to by a least a portion of the linear address,
the metadata data structure included in a linear address space, the address pointer corresponding to an apparent address in an enhanced address space that is larger than the linear address space.
24. The device of claim 23, wherein the instructions that when executed by one or more processors results in additional operations comprising:
comparing a target metadata value in a target address pointer comprising the linear address to the metadata value stored to the metadata data structure; and
generating a fault if the target metadata value and the stored metadata value do not match.
25. The device of claim 23, wherein the metadata data structure is a two level data structure.
US15/201,443 2016-07-02 2016-07-02 Enhanced address space layout randomization Active 2037-02-06 US10191791B2 (en)
US15/201,443 US10191791B2 (en) 2016-07-02 2016-07-02 Enhanced address space layout randomization
PCT/US2017/035784 WO2018009289A1 (en) 2016-07-02 2017-06-02 Enhanced address space layout randomization
CN201780041385.8A CN109416664A (en) 2016-07-02 2017-06-02 The address space layout of enhancing is randomized
DE112017002277.0T DE112017002277T5 (en) 2016-07-02 2017-06-02 Improved address space layout randomization
US16/259,736 US20190235938A1 (en) 2016-07-02 2019-01-28 Enhanced address space layout randomization
US16/259,736 Continuation US20190235938A1 (en) 2016-07-02 2019-01-28 Enhanced address space layout randomization
US20180004445A1 US20180004445A1 (en) 2018-01-04
US10191791B2 true US10191791B2 (en) 2019-01-29
ID=60807034
US15/201,443 Active 2037-02-06 US10191791B2 (en) 2016-07-02 2016-07-02 Enhanced address space layout randomization
US16/259,736 Pending US20190235938A1 (en) 2016-07-02 2019-01-28 Enhanced address space layout randomization
US (2) US10191791B2 (en)
CN (1) CN109416664A (en)
DE (1) DE112017002277T5 (en)
WO (1) WO2018009289A1 (en)
EP0652515A1 (en) 1993-11-09 1995-05-10 Lucas Industries Public Limited Company Memory device, manufacture of such a device and a method of simulating a contiguous memory
US20050193217A1 (en) 2004-03-01 2005-09-01 Case Lawrence L. Autonomous memory checker for runtime security assurance and method therefore
US20060187941A1 (en) 2005-02-23 2006-08-24 Broadcom Corporation Self-correcting memory system
US20060256877A1 (en) 2005-05-13 2006-11-16 Andre Szczepanek Rapid I/O Compliant Message Mapper
US20060256878A1 (en) 2005-05-13 2006-11-16 Andre Szczepanek Out of Order Message Completion Management
US20080209282A1 (en) 2003-11-11 2008-08-28 Samsung Electronics Co., Ltd. Method of managing a flash memory and the flash memory
US20080320336A1 (en) 2007-06-22 2008-12-25 Microsoft Corporation System and Method of Client Side Analysis for Identifying Failing RAM After a User Mode or Kernel Mode Exception
US20090271536A1 (en) 2008-04-24 2009-10-29 Atmel Corporation Descriptor integrity checking in a dma controller
US20100162038A1 (en) 2008-12-24 2010-06-24 Jared E Hulbert Nonvolatile/Volatile Memory Write System and Method
US20110145536A1 (en) 2009-12-11 2011-06-16 Guenter Zachmann Memory leak detection during dynamic memory allocation
US20110173399A1 (en) 2010-01-08 2011-07-14 International Business Machines Corporation Distributed parallel messaging for multiprocessor systems
US20120137167A1 (en) 2010-11-30 2012-05-31 Microsoft Corporation Systematic mitigation of memory errors
US20130013843A1 (en) 2011-07-07 2013-01-10 Zoran Radovic Efficient storage of memory version data
US20130024631A1 (en) 2011-07-18 2013-01-24 Infineon Technologies Ag Method and apparatus for realtime detection of heap memory corruption by buffer overruns
US20130036332A1 (en) 2011-08-05 2013-02-07 Gove Darryl J Maximizing encodings of version control bits for memory corruption detection
US20130173954A1 (en) 2012-01-02 2013-07-04 Samsung Electronics Co., Ltd. Method of managing bad storage region of memory device and storage device using the method
US20130272193A1 (en) 2012-04-17 2013-10-17 Qualcomm Incorporated Methods and apparatus for multiplexing application identifiers for peer-to-peer discovery systems
US20130283105A1 (en) 2012-04-23 2013-10-24 Infineon Technologies Ag Method and System for Realtime Detection of Stack Frame Corruption During Nested Procedure Calls
US20130318405A1 (en) 2011-12-30 2013-11-28 Shino Korah Early fabric error forwarding
US20130318322A1 (en) 2012-05-28 2013-11-28 Lsi Corporation Memory Management Scheme and Apparatus
US20130326288A1 (en) 2011-12-31 2013-12-05 Shamanna M. Datta Processor that detects when system management mode attempts to reach program code outside of protected space
US20140122826A1 (en) 2010-09-30 2014-05-01 Juniper Networks, Inc. Detecting memory corruption
US20140173356A1 (en) 2012-12-14 2014-06-19 International Business Machines Corporation Performing diagnostic tracing of an executing application to identify suspicious pointer values
US20140281336A1 (en) 2013-03-13 2014-09-18 Empire Technology Development, Llc Memory allocation accelerator
US20150106588A1 (en) 2013-10-15 2015-04-16 Mill Computing, Inc. Computer Processor Employing Hardware-Based Pointer Processing
US20150127972A1 (en) 2013-11-01 2015-05-07 Qualcomm Incorporated Method and apparatus for non-volatile ram error re-mapping
US20160048378A1 (en) 2013-04-04 2016-02-18 Pradeep Varma Method for enabling independent compilation of program and a system therefor
US20160259682A1 (en) 2015-03-02 2016-09-08 Intel Corporation Heap management for memory corruption detection
WO2016153586A1 (en) 2015-03-25 2016-09-29 Intel Corporation Byte level granularity buffer overflow detection for memory corruption detection architectures
US20160371179A1 (en) 2015-06-22 2016-12-22 Intel Corporation Multiple chunk support for memory corruption detection architectures
US20160371139A1 (en) 2015-06-19 2016-12-22 Intel Corporation Memory write protection for memory corruption detection architectures
US20170177429A1 (en) 2015-12-21 2017-06-22 Tomer Stark Hardware apparatuses and methods for memory corruption detection
2016-07-02 US US15/201,443 patent/US10191791B2/en active Active
2017-06-02 CN CN201780041385.8A patent/CN109416664A/en active Search and Examination
2017-06-02 DE DE112017002277.0T patent/DE112017002277T5/en active Pending
2017-06-02 WO PCT/US2017/035784 patent/WO2018009289A1/en active Application Filing
2019-01-28 US US16/259,736 patent/US20190235938A1/en active Pending
US20160283300A1 (en) 2015-03-02 2016-09-29 Intel Corporation Byte level granularity buffer overflow detection for memory corruption detection architectures
US20170185535A1 (en) 2015-06-19 2017-06-29 Intel Corporation Memory write protection for memory corruption detection architectures
Angelo-Oracle: "SPARC M7 Chip-32 cores", Oracle.com, Aug. 15, 2014, 7 pages.
Duate: "Memory Translation and Segmentation", Aug. 12, 2008, 8 pages.
Final Office Action issued in U.S. Appl. No. 14/531,498, dated Apr. 21, 2017, 17 pages.
Final Office Action issued in U.S. Appl. No. 14/635,896, dated Aug. 9, 2017, 8 pages.
International Search Report and Written Opinion issued in PCT Application No. PCT/US2016/014180, dated Jul. 11, 2016, 15 pages.
International Search Report and Written Opinion issued in PCT Application No. PCT/US2016/063211, dated Mar. 7, 2017, 11 pages.
Notice of Allowance issued in U.S. Appl. No. 14/531,498, dated Aug. 28, 2017, 12 pages.
Notice of Allowance issued in U.S. Appl. No. 14/531,498, dated Jun. 30, 2017, 8 pages.
Notice of Allowance issued in U.S. Appl. No. 14/668,862, dated May 10, 2017, 5 pages.
Notice of Allowance issued in U.S. Appl. No. 14/746,702, dated Jan. 23, 2017, 11 pages.
Office Action issued in U.S. Appl. No. 14/531,498, dated May 19, 2017, 13 pages.
Office Action issued in U.S. Appl. No. 14/635,896, dated Jan. 26, 2017, 7 pages.
Office Action issued in U.S. Appl. No. 14/668,862, dated Nov. 28, 2016, 10 pages.
Office Action issued in U.S. Appl. No. 14/977,354, dated Jul. 21, 2017, 11 pages.
Office Action issued in U.S. Appl. No. 15/460,977, dated Apr. 21, 2017, 9 pages.
WO2018009289A1 (en) 2018-01-11
CN109416664A (en) 2019-03-01
DE112017002277T5 (en) 2019-01-17
US20180004445A1 (en) 2018-01-04
US20190235938A1 (en) 2019-08-01
TW200813719A (en) 2008-03-16 Avoiding cache line sharing in virtual machines
TW201346591A (en) 2013-11-16 Translation lookaside buffer for multiple context compute engine
US9170940B2 (en) 2015-10-27 Techniques to prelink software to improve memory de-duplication in a virtual system
US20090172330A1 (en) 2009-07-02 Protection of user-level applications based on page table information
US7797650B2 (en) 2010-09-14 System and method for testing SLB and TLB cells during processor design verification and validation
Tatar et al. 2018 Throwhammer: Rowhammer attacks over the network and defenses
US8769355B2 (en) 2014-07-01 Using built-in self test for preventing side channel security attacks on multi-processor systems
JP2008123513A (en) 2008-05-29 Trusted device which has virtual register
US10311228B2 (en) 2019-06-04 Using a fine-grained address space layout randomization to mitigate potential security exploits
US20140372987A1 (en) 2014-12-18 Processor That Records Tracing Data In Non Contiguous System Memory Slices
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:STARK, TOMER;GABOR, RON;NUZMAN, JOSEPH;REEL/FRAME:039082/0402