1. Effective and Efficient memory Protection Using Dynamic Tainting
[James Clause,Doudalis And Guru Venkataramani Members,IEEE]

2. OVERVIEW IMA..? An example IMA Technique-A general approach Tainting
Taint propagation
checking
Limiting the no.of taint marks
Implementation

3. IMA??
Illegal memory access(IMA):An important class of memory related faults
Currently free area ‘m’, of required size is allocated
Starting address of m can be assigned to a pointer ‘p’
Access to m is legal only if it is referenced by p or a pointer derived from p and access occur during the interval when p is valid
All other accesses are ‘Illegal Memory Accesses’ or IMAs

4. AN example IMA void prRandStr ( int n) 1. int i, seed;
2. char *buffer;
3. buffer = (char*) malloc (n);
4. if (buffer == NULL) return;
5. getSeedFromUser (&seed);
6. srand (seed);
7. for (i = 0; i <= n; i++) /*fault*/
8. buffer [i] = rand() %26 + ‘a’ ; /*IMA*/
9. buffer [n-1] = ‘\0’ ;
10. free(buffer);
11. printf (“Random String: %s \n”, buffer);

5. Technique-A general approach
Dynamic tainting: a technigue for marking and tracking certain data at run time
Marking two kinds of data : memory in data space and pointers
When m is allocated, it is tainted with t
When p is created with m as referent, p is also tainted with t
When memory is accessed, taint marks is checked

6. 3 PARTS 1)Tainting Static Memory Allocation
Pointers to Statically Allocated Memory
Dynamically Allocated Memory
Pointers to Dynamically Allocated Memory
2)Taint Propagation
Propagation of Memory taints
Propagation of Pointer taints
3)Checking

7. Tainting Initializing taint marks 4 cases Static Memory Allocation
Pointer to statically allocated memory
Dynamic Memory Allocation
Pointer to dynamic allocated memory

8. Tainting of statically allocated memory
Upon program entry/ function entry, memory for each variable is identified and each is tainted with a fresh taint mark
Memory area for a variable is identified using starting address and size needed to store the variable

9. Pointer to Statically Allocated Memory
For scalar Variable – ‘Address – of’ or ‘&’ returns starting memory address
When ‘&’ operator is used on a variable, pointer is tainted with same taint mark as that of the memory location
For Statically allocated arrays – Name of the array is pointer to first location, which get tainted

10. Dynamic Memory Allocations
Occurs as a result of a call to a memory- allocation function. E.g. malloc
To taint, when the function is about to return, the memory allocated is identified as [r,r+size) and taints the region with a fresh taint mark
r-value returned by m/y allocation function
size –amount of m/y requested

11. Pointers to Dynamically allocated Memory
Created either directly (as return value of allocation function) or indirectly (from another pointer)
When a memory area is tainted as a result of call to a memory allocation function, the return value, i.e the corresponding pointer is also tainted with the same mark.
When other pointers are derived from that pointer, the taint mark is propagated to them.

12. Taint Propagation
Detects how taint marks flow along data as program executes.
2 concepts:
Propagation of memory taints
Propagation of pointer taints

13. Propagation of Memory Taints
Not actually propagated.
Taint marks are associated with a memory area when it is allocated and removed when deallocated
Pointers remain tainted
If such a pointer is used to access memory ,an IMA still detected.

14. Dynamically allocated memory – deallocated and taint mark will be removed by calling a memory deallocation function, e.g.: free
Statically allocated memory- deallocated and taint mark is removed when the function returns (local variable) or when program exits (global variables)

15. Propagation of Pointer Taints
Taint marks associated with pointers propagated to derived pointers.
The rules models all possible operations on pointers and associate,for each operation an action that assigns to the result of the operation the correct pointer taint mark.

16. Propagation rules Add, Subtract c = a +/- b
a tainted with ta, b tainted with tb
Then c will be tainted with ta + tb or ta – tb
Multiply, Divide, Modulo, Bitwise OR, XOR
Result of these operations are never tainted

17. Bitwise AND
c = a & b
If a and b both tainted/ untainted, c is not tainted, else it is tainted
Bitwise NOT
c = ~ a
Alternative to subtraction
tc = - ta

18. checking
For each memory access, taint mark of the pointer and memory is checked. If they are not the same, an IMA is detected

19. Limiting number of taints
Ideal condition – unlimited number of taints
Realistically, number of taints should be limited
Memory consumption
Complexity of hardware
While retaining ability to detect maximum IMAs

20. Each taint mark is represented with n bits
Number of taint marks is limited to 2^n
Probability of detecting each IMA will be
P = 1- (1/ 2^n)

21. Software Implementation
An additional pass is added in compiler (LLVM) to taint all stack and global defined arrays.
Taint propagation may be implemented using any dynamic tainting framework

22. Hardware Based Implementation
Taint Processing and Storage
2 options: data widening, decoupling
Data widening: extending data with a few bits to represent the taint information
Decoupling: Taint information is stored as a packed array in a reserved part of the application’s virtual address space
This address space is managed by OS similar to normal data pages

23. Taint Propagation and Access Checking
2 options: hard wiring / programming an accelerator
Hardwiring would require modifications in the hard wiring for making changes in future, whereas it would be easier to reprogram the accelerator

24. But for adding different propagation strategies for each pointer operations, exceptions should be made for each operator in case of software accelerator
Easier to add a hardwire support for taint operations
As a result of all these considerations, a hard wiring approach is opted for taint propagation and access checking

25. In short,
Taint processing and Initialization is done using decoupling
Taint Propagation and Checking is done using Hard wiring technique

26. Conclusion A dynamic technique for detecting IMAs was studied
With minimum number of taint bits, maximum number of IMAs are detected
Only actual IMAs are reported and no false detections are made

27. Future Scope
Technique can be improved to use software accelerators instead of hard wiring techniques for taint propagation and checking
Can be improved to increase probability of detecting IMAs with reduced resource utilisation

28. References
IEEE Transactions on Computers, vol 61, no 1, January 2012, “Effective and Efficient Memory Protection using Dynamic Tainting” by Ioannis Doudalis, James Clause, Guru Venkataramani, Milos Prvulovic,and Alessandro Orso.
G. Venkataramani, Doudalis, y.solihin”FlexiTaint :A programmable accelerator for dynamic taint propagation”
Doudalis, James Clause,A.orso”Effective memory protection
using dynamic tainting”.proc.22nd IEEE 2007.

29. THANK YOU…

30. Questions….