1. Enhancing Availability and Security Through Failure-Oblivious Computing Martin Rinard, Cristian Cadar, Daniel Dumitran, Daniel Roy, and William Beebee, Jr.

2. Introduction Memory errors are a common source of program failures  ML and Java use dynamic checks to eliminate such errors Assumption:  Invalid memory access  unsafe to continue the execution

3. Failure-Oblivious Computing Instead of throwing an exception or terminating  Ignores any memory access errors and continue  Read (an out of bounds array element) Just read a manufactured value  Write (an out of bounds array element) Discard the value

4. Wrong Results? Many programs can continue to run  As long as errors do not corrupt the program’s address space or data structures Failure-oblivious computing can improve the availability, robustness, and security of such programs

5. Shouldn’t We Stop at the First Error? Debugging may not be an option  No source code  Not enough time Failure-oblivious computing can still provide acceptable service  Better than no service

6. Servers and Buffer-overrun Attacks When a program allocates a fixed-size buffer  Then fails to check if input string fits in the buffer  A long input string containing executable code can overwrites the stack contents Can coerce the server into running arbitrary code

7. Servers and Buffer-overrun Attacks Failure-oblivious computing discards the excess characters, preserving the integrity of the stack  Server detects invalid request and returns an error  Converts a dangerous attack into an invalid input

8. Multiple Items or Outputs Many programs (e.g. mail readers) process multiple items Some applications generate multiple outputs  Some outputs are more important than others Without failure-oblivious computing  Failure to process one can prevent the program to process the rest

9. Benefits and Drawbacks + Increased resilience  Graceful degradation and continue to operate successfully on most of its inputs + Increased security  Can survive stack overruns + Reduced development costs  Pressured to find and eliminate all disruptive bugs + Reduced administration overhead  Reduce the success rate of attacks

10. Benefits and Drawbacks + Safer integration  Lowers the risks to use foreign components - May generate unacceptable results  Inevitable consequence for better resiliency  Need to convert unanticipated states into anticipated error states

11. Scope Interactive computing environments  Mailers  Servers  System administration tools  Operating systems  Document processing systems Mission critical applications  Halting is not an option

12. Scope Less appropriate for programs  Hard to determine whether the output is correct Safety-critical applications  Safer to terminate the computation

13. Example A Mutt procedure  Takes an input string  Returns an encoded output string  Fails to allocate sufficient space With standard compilers  Writes succeed, corrupt the address space, and program segfaults With safe-C compilers  Mutt exits before presenting the GUI

14. Example With the failure-oblivious compiler  The returned string is incorrect  Server responds with an error Failure oblivious approach works  Mostly correct programs With subtle errors

15. Implementation Failure oblivious compiler  Generate two kinds of additional code Checking code  Discard erroneous writes  Manufactures values for erroneous reads Continuation code  Executes when checking code detects an attempt to perform illegal access

16. Checking Code Jones and Kelly’s Scheme  Track the locations to structs, arrays, variables  Each data item is padded with an extra byte Initialized to ILLEGAL  Check the status of each pointer before dereferencing it

17. Continuation Code Write continuation code  Discards the value Read continuation code  Redirects the read to a preallocated buffer of values Iterates through all small integers Increasing the chance to exit loops  To avoid nontermination Mostly 0s and 1s

18. Continuation Code Optional logging  Can be used to track down errors Failure-oblivious computing  Can also reduce the incentive to eliminate errors

19. Case Studies Recompiled widely-used open-source programs with known memory errors  Pine (mail user agent)  Midnight commander (file manager)  Sendmail (mail transfer agent)  Mutt (mail user agent)  Samba (file server)  WsMp3 (mp3 server)  Apache (http server)

20. Methodology Compare each program compiled differently  By a standard C compiler  By the CRED safe-C compiler  By the failure-oblivious compiler Workloads  Contain inputs that exploit known security vulnerabilities

21. Pine 4.44 Fails to parse certain legal From fields  Possible to execute arbitrary code Standard version: crashed Safe version: terminated with an error Failure oblivious version: continued to run  Was able to forward the read and forward the message with the problematic From field

22. Midnight Commander Problems with symbolic links in tgz files Standard version: segfaulted Safe version: terminated with an error message Failure-oblivious version: continued to run

23. Sendmail 8.11.6 Allows root privilege to execute arbitrary code on the machine running the Sendmail server Standard version: vulnerable to an attack to gain the root shell Safe version: exited with an error message Failure-oblivious version: not vulnerable to the attack

24. Mutt 1.4 Memory error in the conversion from UTF-8 to UTF-7 string formats Standard version: crashed Safe version: exited with an error message Failure oblivious version: continued to run  6x slow down  Took about 1 second to load 3,000 messages

25. Samba 2.2.5 Memory corruption error  A remote user can obtain the root shell Standard version: vulnerable to an attack to gain the root shell Safe version: functional until the attack  The child process exited Failure oblivious version: continued to run  Similar performance compared to the safe version

26. WsMp3 0.0.5 Memory-error vulnerability Standard version: segfaulted Safe version: crashed the entire server  Single threaded Failure-oblivious version: survived the attack

27. Apache 2.0.47 mod_alias contains a memory-error vulnerability Standard version: child process segfaulted Safe version: child process exited properly Failure-oblivious version: child process redirected the attacking request to a nonexistent URL  The child process stayed alive and processed subsequent requests correctly

28. Gzip 1.2.4a Memory error in its file name processing code  An attacker can run arbitrary code Standard version: segfaulted  Remaining files were not processed Safe version: exited at the problematic file Failure-oblivious version: prompted an error message for the problematic files  Proceeded to process all remaining files  10x slow down (1.2 MB/sec)

29. Discussion Failure oblivious versions survived all memory-corruption attempts  Work well for this class of applications One input has a minimal effect on the next input Unless it corrupts the data structures or address space  Little performance degradation for interactive programs Safe versions are prone to DoS attacks  Tend to terminate prematurely

30. Related Work Any safe-C compiler can be modified to implement a failure-oblivious compiler  Discard writes  Manufacture values for unsafe reads Typically < 2x slow down  Occasionally 8x slow down  Does not perceptibly degrade the response times of interactive programs Also I/O-bound programs

31. Safe Languages Java and ML  Modify the exception handling code Discard illegal writes Return manufactured values for illegal reads

32. Traditional Error Recovery Traditional approaches  Reboot  Checkpointing  Partial system restarts  Hardware redundancy Failure-oblivious computing reduces down time and vulnerabilities to persistent errors  Restarting Pine will not solve the problem

33. Other Approaches Data structure repair  Failure-oblivious approach is preventive Statically detect all buffer-overrun errors  May conservatively reject almost working code Buffer-overrun detection tools  Detect overwriting the return address  Detect overwriting function pointers  Failure-oblivious approach prevents the attack from corrupting the address space

34. Conclusion Failure-oblivious computation enhances availability, resilience, and security  Converts dangerous unknown system states to known error cases