Use-After-Free Exploit Again?!?

-

 


It's an all too common attack. Hackers break C code by finding a way to re-use a freed pointer. A recent exploit was serious enough for Google to issue an emergency Chrome update.

For a business perspective, read the Forbes article.

For a technical look, watch the youtube video from Low Level.

This is an old problem with an old, and apparently forgotten, solution.

I've written about before: Pointers Don't Create Memory Bugs, Programmers Do.

Just set your pointer to NULL after freeing it:

    free (ptr);
    ptr = NULL;

It's a simple measure, and can be made even simpler with a macro:

    #define FREE(ptr)    (free(ptr), ptr = NULL) 

Thus, any subsequent use of the NULL pointer will trigger a segment fault (crash) and make any exploit useless. A bonus benefit is that it could catch stray pointers in development and QA, rather than have them wait silently in production.

While this technique won't catch every use-after-free attack, I'd argue it would prevent most. It's a good first line of defense that should be in every C/C++ developers toolkit.


Comments

Post a Comment

Popular posts from this blog

MR2 Check Engine

-
Image
Shown here is the 1991 Toyota MR2. Thanks to the mechanical skills of a family enthusiast, it purrs, growls, and turbo whistles like a dream.   My hardware ability doesn't go much further than oil changes. Rather, my expertise is in software, and I wrote an app for Android and iOS to diagnose the flashes of the check engine light. This second generation MR2 predates the OBD2 connector, a standard used to diagnose engine, transmission, and emissions problems quickly and easily. Instead, we have a flashing check engine light which needs some deciphering, followed by a lookup in the service manual. Basically, you count flashes to arrive at fault code number. A short pause (~1.5 seconds) indicates the start of the next digit. A medium pause (~2.5 seconds) indicates start of the next fault code. And a long pause (~4.5 seconds) means the sequence has ended and will repeat. The video below corresponds to the codes 41 and 51. Using the the MR2 Check app and selecting the 3S-GTE engine...
Read more

Raspberry Pi 5 Resource Limits

-
Image
I was fortunate enough to get a Raspberry Pi 5. I had no particular purpose for it other than to explore it and have fun. On UNIX and Linux based systems, part of that exploration involves checking the default resource limits . The screen shot above is a vimdiff of the rlimits for the Raspberry Pi 400 (left) and the Raspberry Pi 5 (right). Both are running their respective 64-bit versions of Raspberry Pi OS. Four of the 15 resources turned up with diffs, and it's no surprise that the pi5 would have the higher limits. These include the number of processes , the locked-in-memory address space , the number of pending signals , and the realtime priority .  They all serve the common purpose of improving realtime performance.  The last item, realtime priority , is the most telling.  On the pi400, the current and max values are 0.  On the pi5, they are 2.  These settings most likely support hardware destined for the Pi5's new PCIe connector. For a detailed review o...
Read more