Memory vulnerability protection method and device, electronic equipment and storage medium

Abstract

The invention provides a memory vulnerability protection method and device, electronic equipment and a storage medium, and relates to the technical field of computers. The memory vulnerability protection method comprises the following steps: performing semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; according to the pointer access context information, inserting a protection code aiming at the sensitive pointer variable in an intermediate representation language of the target program so as to realize memory vulnerability protection aiming at the sensitive pointer variable by utilizing the protection code in the running process of the target program; wherein the protection code comprises a plurality of code segments realized based on an instruction provided by the memory tag architecture. According to the method, efficient and comprehensive memory protection can be carried out for the system-level programming language, so that memory vulnerabilities are prevented from being utilized.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a memory vulnerability protection method, device, electronic device and storage medium. Background Art

[0002] In the field of computer science, system-level programming languages ​​(e.g., C / C++) are widely used in key areas such as system-level development and low-level drivers as an efficient programming language. However, the memory management characteristics of system-level programming languages ​​also bring significant security risks. Since system-level programming languages ​​allow pointers to directly access memory, have fewer access restrictions, and support arbitrary arithmetic operations and type conversions, this leads to a serious imbalance between the flexibility and security of memory access. At the same time, system-level programming languages ​​lack explicit memory access boundary checks and native object lifecycle management mechanisms, further exacerbating the risk of memory vulnerabilities. Memory corruption vulnerabilities mainly include two categories: spatial memory corruption vulnerabilities, such as out-of-bounds access; and temporal memory corruption vulnerabilities, such as use-after-free, which are common security threats in system-level programming language programs. These vulnerabilities may not only cause program crashes, but may also be exploited by malicious attackers to execute arbitrary code, thereby seriously endangering the security and stability of the system.

[0003] To address this challenge, the industry has proposed an innovative technology called memory tag architecture. The memory tag architecture maintains additional security metadata, namely memory tags, for each memory unit by enhancing the memory representation capability at the hardware level. Memory tags are dynamically updated as operations such as memory allocation, release, and access are performed, and are updated and verified efficiently through a series of instructions. Compared with traditional software implementations, the memory tag architecture has significant performance advantages, and because memory tags are stored in locations that are not directly accessible, they are more effective in resisting attacks on metadata. However, its high overhead and the fact that it only provides probabilistic protection still limit the widespread application of the memory tag architecture in actual business deployments.

[0004] Therefore, for system-level programming languages, how to perform efficient and comprehensive memory protection to prevent memory vulnerabilities from being exploited is a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of the above problems existing in the prior art, the present invention provides a memory vulnerability protection method, device, electronic device and storage medium to achieve efficient and comprehensive memory protection for system-level programming languages ​​to prevent memory vulnerabilities from being exploited.

[0006] The present invention provides a memory vulnerability protection method, comprising the following steps.

[0007] A target program is semantically analyzed to obtain pointer access context information in the target program; wherein the target program runs on a processor having a memory tag architecture; based on the pointer access context information, protection code for sensitive pointer variables is inserted into an intermediate representation language of the target program, so that during the running of the target program, the protection code is utilized to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes a plurality of code segments implemented based on instructions provided by the memory tag architecture.

[0008] According to a memory vulnerability protection method provided by the present invention, the intermediate representation language of the target program includes the compiler intermediate representation language and the machine intermediate representation language of the target program, and the compiler intermediate representation language is a pre-representation form of the machine intermediate representation language; the protection code for the sensitive pointer variable is inserted into the intermediate representation language of the target program according to the pointer access context information, including: inserting a meta-information tag into the compiler intermediate representation language according to the pointer access context information; wherein the meta-information tag is used to indicate the location where the protection code is called in the target program; and inserting the protection code into the machine intermediate representation language according to the meta-information tag.

[0009] According to a memory vulnerability protection method provided by the present invention, the pointer access context information includes first context information for accessing a sensitive pointer variable, the meta-information tag includes a first meta-information tag and a second meta-information tag, and the multiple code segments include a first code segment and a second code segment; inserting the meta-information tag in the compiler intermediate representation language according to the pointer access context information includes: determining a first position of a write instruction and a second position of a read instruction for the sensitive pointer variable in the compiler intermediate representation language according to the first context information; inserting the first meta-information tag according to the first position; inserting the second meta-information tag according to the second position; inserting the meta-information tag in the machine intermediate representation language according to the meta-information tag The protection code comprises: according to the first meta-information tag, inserting the first code segment into the machine intermediate representation language, so as to use the first code segment to instruct the memory tag architecture to set the tag of the memory area where the sensitive pointer variable is located to a first preset non-zero value; wherein the memory tag architecture is configured to: when storing data into the memory area, update the tag of the memory area to a zero value; according to the second meta-information tag, inserting the second code segment into the machine intermediate representation language, so as to use the second code segment to instruct the memory tag architecture to verify whether the tag of the memory area where the sensitive pointer variable is located is the first preset non-zero value; wherein, when the verification result is that the tag of the memory area is a zero value, it is determined that the value of the sensitive pointer variable has been tampered with.

[0010] According to a memory vulnerability protection method provided by the present invention, the first code segment is inserted into the machine intermediate representation language according to the first meta-information tag, so as to use the first code segment to indicate the memory tag architecture and set the tag of the memory area where the sensitive pointer variable is located to a first preset non-zero value, including: according to the first meta-information tag, the first code segment is inserted into the machine intermediate representation language to use the first code segment to indicate the memory tag architecture and set the tag of the memory area where the sensitive pointer variable is located to 1; according to the second meta-information tag, the second code segment is inserted into the machine intermediate representation language to use the second code segment to indicate the memory tag architecture and verify whether the tag of the memory area where the sensitive pointer variable is located is the first preset non-zero value, including: according to the second meta-information tag, the second code segment is inserted into the machine intermediate representation language to use the second code segment to indicate the memory tag architecture and verify whether the tag of the memory area where the sensitive pointer variable is located is 1.

[0011] According to a memory vulnerability protection method provided by the present invention, the pointer access context information includes first context information for accessing sensitive pointer variables, and second context information for accessing non-sensitive pointer variables, the meta-information tag includes a third meta-information tag and a fourth meta-information tag, and the multiple code segments also include a third code segment and a fourth code segment; inserting the meta-information tag in the compiler intermediate representation language according to the pointer access context information includes: determining a third position of a write instruction for the non-sensitive pointer variable in the compiler intermediate representation language according to the second context information; inserting the third meta-information tag after the third position; determining a fourth position of a read instruction for the sensitive pointer variable in the compiler intermediate representation language according to the first context information; and inserting the A fourth meta-information tag; inserting the protection code into the machine intermediate representation language according to the meta-information tag comprises: inserting the third code segment into the machine intermediate representation language according to the third meta-information tag, so as to use the third code segment to instruct the memory tag architecture to set the tag of the memory area where the non-sensitive pointer variable is located to a second preset non-zero value; wherein the memory tag architecture is configured to: update the tag of the memory area to a zero value when storing data into the memory area; inserting the fourth code segment into the machine intermediate representation language according to the fourth meta-information tag, so as to use the fourth code segment to instruct the memory tag architecture to verify whether the tag of the memory area where the sensitive pointer variable is located is a zero value; wherein, when the verification result is that the tag of the memory area is a non-zero value, it is determined that the value of the sensitive pointer variable has been tampered with.

[0012] According to a memory vulnerability protection method provided by the present invention, the sensitive pointer variable is a class object pointer, and the protection code also includes a first anti-reuse code segment and a second anti-reuse code segment; the inserting of the protection code for the sensitive pointer variable in the intermediate representation language of the target program according to the pointer access context information also includes: determining, according to the first context information, a fifth position where the object corresponding to the sensitive pointer variable is instantiated in the intermediate representation language of the compiler; inserting the first anti-reuse code segment according to the fifth position, so as to use the first anti-reuse code segment to assign an anti-reuse tag to the sensitive pointer variable; wherein the anti-reuse tag is passed to all virtual table pointers of the object through the constructor of the object; determining, according to the first context information, a sixth position in the intermediate representation language of the compiler where the virtual table pointer of the target virtual function is obtained when the sensitive pointer variable is used to access the target virtual function; inserting the second anti-reuse code segment according to the sixth position, so as to use the second anti-reuse code segment to determine whether the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are consistent; wherein, in the case where the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are inconsistent, confirming that the sensitive pointer variable is reused.

[0013] The present invention also provides a memory vulnerability protection device, comprising the following modules: an analysis module, used to perform semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; an insertion module, used to insert protection code for sensitive pointer variables in the intermediate representation language of the target program according to the pointer access context information, so as to utilize the protection code during the running of the target program to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-mentioned memory vulnerability protection methods when executing the computer program.

[0015] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the memory vulnerability protection method described in any one of the above is implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned memory vulnerability protection methods.

[0017] The memory vulnerability protection method, device, electronic device and storage medium provided by the present invention perform semantic analysis on the target program to obtain pointer access context information; based on the pointer access context information, protection code for sensitive pointer variables is inserted into the intermediate representation language of the target program. Through multiple code segments implemented by instructions provided by the memory tag architecture, comprehensive protection against memory corruption vulnerabilities is achieved with less hardware overhead, thereby performing efficient and comprehensive memory protection for system-level programming languages ​​to prevent memory vulnerabilities from being maliciously exploited. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is one of the flow charts of the memory vulnerability protection method provided by the present invention.

[0020] Figure 2 This is the second flow chart of the memory vulnerability protection method provided by the present invention.

[0021] Figure 3 This is the third flow chart of the memory vulnerability protection method provided by the present invention.

[0022] Figure 4 This is the fourth flow chart of the memory vulnerability protection method provided by the present invention.

[0023] Figure 5 It is a schematic diagram of the effect of the memory vulnerability protection method provided by the present invention.

[0024] Figure 6 It is a schematic diagram of the implementation process of the memory vulnerability protection method provided by the present invention.

[0025] Figure 7 It is a structural schematic diagram of the memory vulnerability protection device provided by the present invention.

[0026] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] In order to deal with the insufficient performance of source check in terms of memory corruption vulnerabilities, the present invention proposes a method for exploiting memory corruption vulnerabilities to protect programs. Among the many attack methods, control flow hijacking attacks are particularly common. This attack exploits memory corruption vulnerabilities to tamper with code pointers in memory, thereby hijacking the control flow of the program, which may lead to serious consequences such as remote code execution.

[0029] Control flow refers to the order of instructions when a program is executed. In system-level programming languages ​​(e.g., C / C++), control flow is not only affected by conditional statements and loop statements, but also strongly depends on pointer values ​​in memory. Control flow transfer in system-level programming languages ​​is mainly divided into forward control flow transfer (such as indirect calls and jumps using function pointers) and backward control flow transfer (such as returning using return addresses). Both transfer methods rely on function pointers and return addresses stored in plain text in memory, which can be accessed and modified through pointers.

[0030] If an attacker attempts to hijack control flow by exploiting a memory corruption vulnerability, they must tamper with or reuse a critical pointer that affects control flow. Pointer tampering refers to the modification of a pointer by an instruction that is not permitted by the program semantics, for example, a pointer is overwritten by a storage instruction that should not access it due to a memory vulnerability. Pointer reuse refers to the reuse of a pointer in an illegal context, such as a dangling pointer being used to access memory after the object it originally pointed to is released, thereby potentially accessing a memory object that should not be accessed.

[0031] Combine the following Figure 1-Figure 6 The memory vulnerability protection method of the present invention is described.

[0032] Figure 1 This is one of the flow charts of the memory vulnerability protection method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 101: Perform semantic analysis on the target program to obtain pointer access context information in the target program.

[0033] The target program is a program implemented in a system-level programming language that contains sensitive pointer variables and needs to protect the sensitive pointer variables. The target program runs on a processor with a memory tag architecture.

[0034] Sensitive pointer variables refer to those used when processing sensitive data or performing critical tasks. These pointer variables require extra security attention and protection due to their special uses.

[0035] The memory tag architecture is a security technology that combines software and hardware. It sets memory tags for data stored in memory according to instructions. These memory tags are stored in the memory area together with the data as additional security metadata. At the same time, the memory tag architecture also provides a verification mechanism for memory tags, which can verify the memory tags of data stored in memory according to instructions. In some embodiments, the memory tag architecture can provide memory tags of multiple granularities, for example, 1-bit memory tags, or 4-bit memory tags.

[0036] In the specific implementation process, the memory tag architecture can be implemented based on a variety of methods and is not limited to the description of this specification.

[0037] Pointer access context information refers to various information and states closely related to pointer access operations during program execution, such as the source, target address, access type, and surrounding code logic of the pointer.

[0038] In the specific implementation process, the program analysis module can be realized by deeply customizing and expanding the functions of LLVM (Low Level Virtual Machine). This module can capture the key semantic details of pointer access from the source code of the target program and the LLVM intermediate representation language, such as the specific location of the virtual table pointer of an object in the target program. At the same time, it can also extract important semantic information such as variable types from the LLVM intermediate representation language.

[0039] Step 102: insert protection codes for sensitive pointer variables into the intermediate representation language of the target program according to the pointer access context information, so as to implement memory vulnerability protection for sensitive pointer variables by utilizing the protection codes during the running of the target program.

[0040] The intermediate representation language of the target program includes the compiler intermediate representation language and the machine intermediate representation language of the target program. The compiler intermediate representation language is a pre-representation form of the machine intermediate representation language.

[0041] The protection code consists of multiple code segments implemented based on instructions provided by the memory tag architecture.

[0042] Since the instructions provided by the memory tag architecture are instructions for the underlying hardware (for example, assembly instructions), they cannot be directly called and executed in the target program implemented in the system-level language. They need to be inserted into the machine intermediate representation language to call the instructions provided by the memory tag architecture during the running of the target program.

[0043] In some embodiments, a meta-information tag is inserted into the compiler intermediate representation language based on pointer access context information; wherein the meta-information tag is used to indicate the location where the protection code is called in the target program; and the protection code is inserted into the machine intermediate representation language based on the meta-information tag.

[0044] Meta information tags are special tags used in the machine intermediate representation language (IR) to instruct the compiler to insert a specific code segment at a specific location. The specific syntax and purpose of these tags vary from compiler to compiler and IR design. For example, a meta information tag could be [xx_insert], which instructs the compiler to insert a specific code segment at that location at a certain stage.

[0045] In the specific implementation process, this step can be performed using a program instrumentation module, which inserts protection code into the intermediate representation language of the target program based on pointer access context information to achieve seamless integration with the memory tag architecture while ensuring that the integrity of the target program function is not affected.

[0046] In the specific implementation process, the protection code also includes functions in the runtime library. The runtime library provides a series of helper functions that can assist in the update and labeling of memory tags. Figure 6 As shown, the runtime library is linked to the binary executable file of the target program. When the target program is running, the auxiliary target program interacts with the memory tag architecture.

[0047] In the specific implementation process, memory vulnerability protection for sensitive pointer variables can be implemented by using protection codes in a variety of ways, which is not limited by the description of this specification.

[0048] For multiple implementations of using protection code to implement memory vulnerability protection for sensitive pointer variables, see Figure 2 , Figure 3 as well as Figure 4 The relevant content in will not be repeated here.

[0049] Figure 2 This is the second flow chart of the memory vulnerability protection method provided by the present invention.

[0050] In this embodiment, the pointer access context information includes first context information for accessing the sensitive pointer variable, the meta information tag includes a first meta information tag and a second meta information tag, and the multiple code segments include a first code segment and a second code segment. Figure 2 As shown, the method includes the following: Step 201: Determine, according to first context information, a first position of a write instruction and a second position of a read instruction for a sensitive pointer variable in an intermediate representation language of a compiler.

[0051] The first context information includes context information of a write instruction or a read instruction for a sensitive pointer variable. The first position of the write instruction and the second position of the read instruction for the sensitive pointer variable in the compiler intermediate representation language can be determined based on the first context information.

[0052] Step 202: insert a first meta information tag according to the first position.

[0053] Step 203: insert a second meta-information tag according to the second position.

[0054] Step 204: insert a first code segment into the machine intermediate representation language according to the first meta-information tag, so as to use the first code segment to indicate the memory tag architecture and set the tag of the memory area where the sensitive pointer variable is located to a first preset non-zero value.

[0055] The first code segment includes an assembly instruction for instructing the memory tag architecture to set the label of the memory area where the sensitive pointer variable is located to a first preset non-zero value. The code segment not only includes instructions provided by the memory tag architecture and specifically used to modify the label of the specified memory area, but also includes instructions for preparing the registers required to execute this instruction. Specifically, these registers include a register for storing the starting address of the memory area whose label is to be modified (e.g., register A), and another register for storing the first preset non-zero value (e.g., register B).

[0056] Just as an example, pseudo code for the first code snippet looks like this: "; Load the starting address of the memory area storing the sensitive pointer variable into register A MOV A, [the starting address of the memory area where sensitive pointer variables are stored] ; Load the first preset non-zero value into register B MOV B, first preset non-zero value ; Use specific instructions (e.g., SET_TAG) to modify the tag of a memory region SET_TAG A, B".

[0057] In this embodiment, the memory tag architecture is configured to update the tag of the memory area to a zero value when storing data in the memory area. Therefore, when the processor executes a storage instruction for data in the memory area, the memory tag architecture simultaneously updates the tag of the memory area to a zero value. Since the first code segment is inserted at the first position of the write instruction for the sensitive pointer variable, after the target program modifies the sensitive pointer variable, the tag of the memory area storing the sensitive pointer variable is a first preset non-zero value; after the code in the non-target program modifies the sensitive pointer variable, the tag of the memory area storing the sensitive pointer variable is a zero value.

[0058] In the specific implementation process, the first preset non-zero value can be set according to the actual application situation, which is not limited by the description of this specification. For example, if the memory tag occupies 2 bits, the first preset non-zero value can be a value of 1 (binary 01), 2 (binary 10) or 3 (binary 11).

[0059] In some embodiments, the memory tag architecture provides a 1-bit memory tag for each machine word in the memory, and the first preset non-zero value is 1. The first code segment instructs the memory tag architecture to set the tag of the memory area where the sensitive pointer variable is located to 1.

[0060] Step 205: insert a second code segment into the machine intermediate representation language according to the second metadata tag, so as to utilize the second code segment to indicate the memory tag architecture and verify whether the tag of the memory area where the sensitive pointer variable is located is a first preset non-zero value.

[0061] The second code segment includes an assembly instruction for instructing the memory tag architecture to verify whether the tag of the memory area where the sensitive pointer variable is located is a first preset non-zero value. This code segment not only includes instructions provided by the memory tag architecture specifically for verifying the tag of the specified memory area, but also includes instructions for preparing the registers required to execute this instruction. As an example only, the second code segment is as follows: "; Assume that the sensitive pointer variable is stored in register R1, and the memory tag architecture is configured such that when data is loaded from the memory area to the register, the tag of the memory area is loaded at the same time. Therefore, the memory tag corresponding to the sensitive pointer variable is also stored in register R1. ; Assume that the first preset non-zero value is stored in register R2 ; Assume the memory tag verification instruction is VERIFY_TAG, which accepts two parameters: the memory address (R1) and the first preset non-zero value (R2) ; Set R2 to the first preset non-zero value MOV R2, #0x02; Here 0x02 is the first preset non-zero value ; Call memory tag verification instruction VERIFY_TAG R1, R2; Verify that the tag stored in R1 is the same as the value in R2".

[0062] When the verification result shows that the tag of the memory area is zero, it is determined that the value of the sensitive pointer variable has been tampered with. Figure 5 As shown, the memory exception protection function provided by the memory tag architecture can be used to throw an exception, prevent control flow hijacking attacks, and terminate the running target program.

[0063] In some embodiments, the memory tag architecture provides a 1-bit memory tag for each machine word in the memory, and the first preset non-zero value is 1. The second code segment instructs the memory tag architecture to verify whether the tag of the memory region where the sensitive pointer variable is located is 1.

[0064] The memory vulnerability protection method of step 201 to step 205 provides a high level of protection for sensitive pointer variables, and only allows instructions inside the target program to modify sensitive pointer variables. However, in actual application, the target program often needs to be linked with a third-party library. Due to the limitations of the above-mentioned memory vulnerability protection method, it does not allow the code in the third-party library to directly modify the sensitive pointer variables in the target program, so this method is suitable for scenarios where links are made with untrusted third-party libraries.

[0065] For memory vulnerability protection methods for scenarios linked with trusted third-party libraries, see Figure 4 The relevant content in will not be repeated here.

[0066] Figure 3 This is the third flow chart of the memory vulnerability protection method provided by the present invention.

[0067] In this embodiment, the sensitive pointer variable is a class object pointer, and the protection code further includes a first anti-reuse code segment, a second anti-reuse code segment, an anti-restore tag, an anti-restore tag, and an anti-restore tag.

[0068] like Figure 3 As shown, the method includes the following: Step 301: Determine, according to the first context information, a fifth position in the compiler intermediate representation language where an object corresponding to the sensitive pointer variable is instantiated.

[0069] Step 302: insert the first anti-reuse code segment according to the fifth position, so as to use the first anti-reuse code segment to assign an anti-reuse tag to the sensitive pointer variable.

[0070] The first anti-reuse code segment is used to assign an anti-reuse tag to a sensitive pointer variable. The anti-reuse tag is stored in the high bits of the pointer (for example, the high 4 bits), and only a limited number of low bits of the pointer participate in address resolution. Modifying the high-bit value of the pointer does not affect the normal resolution address of the pointer. The anti-reuse tag is passed to all virtual table pointers of the object corresponding to the sensitive pointer variable through the constructor of the object.

[0071] Step 303: Determine, according to the first context information, in the compiler intermediate representation language, the sixth position of the virtual table pointer of the target virtual function when the sensitive pointer variable is used to access the target virtual function.

[0072] The virtual table pointer is a hidden pointer member variable that exists in each object of a class that contains virtual functions and points to the virtual function table (also called the virtual table) of the class, which stores the addresses of each virtual function in the class. When the sensitive pointer variable calls the target virtual function, the system obtains the virtual table pointer of the object and uses the current position as the sixth position.

[0073] Step 304: insert a second anti-reuse code segment according to the sixth position, and use the second anti-reuse code segment to determine whether the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are consistent.

[0074] The second anti-reuse code segment is used to determine whether the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are consistent. When the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are inconsistent, it means that the virtual table pointer now points to a completely different object or memory area, which may not contain the expected virtual table or may contain a maliciously constructed virtual table. In this case, if a virtual function is called through the virtual table pointer, undefined behavior or security vulnerabilities may be triggered. Therefore, when the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are inconsistent, it is confirmed that the sensitive pointer variable is reused. At this time, if Figure 5 As shown, the function in the runtime library can be called to throw an exception, prevent the control flow hijacking attack, and terminate the running target program.

[0075] Figure 4 This is the fourth flow chart of the memory vulnerability protection method provided by the present invention.

[0076] In this embodiment, the pointer access context information includes first context information for accessing sensitive pointer variables and second context information for accessing non-sensitive pointer variables, the meta-information tag includes a third meta-information tag and a fourth meta-information tag, and the plurality of code segments also include a third code segment and a fourth code segment. Figure 4 As shown, the method includes the following: Step 401: Determine, according to the second context information, a third position of a write instruction for a non-sensitive pointer variable in the intermediate representation language of the compiler.

[0077] Non-sensitive pointer variables are pointers that do not point to sensitive data. Non-sensitive pointer variables may point to ordinary data structures, buffers, file descriptors, etc., which do not contain or involve sensitive information.

[0078] Step 402: insert a third metadata tag after the third position.

[0079] Step 403: Determine, according to the first context information, a fourth position of a read instruction for a sensitive pointer variable in the intermediate representation language of the compiler.

[0080] Step 404: insert a fourth metadata tag before the fourth position.

[0081] Step 405: insert a third code segment into the machine intermediate representation language according to the third metadata tag, so as to use the third code segment to indicate the memory tag architecture and set the tag of the memory area where the non-sensitive pointer variable is located to a second preset non-zero value.

[0082] The third code segment is used to indicate the memory tag architecture and set the tag of the memory area where the non-sensitive pointer variable is located to a second preset non-zero value (for example, 1). For the implementation of the third code segment, refer to the description of the first code segment, which will not be repeated here.

[0083] The memory tag architecture is configured to update the tag of the memory area to a zero value when storing data in the memory area. Therefore, in this embodiment, the tag of the memory area where the non-sensitive pointer variable is located is a second preset non-zero value, and the tag values ​​of the remaining memory areas are zero values.

[0084] Step 406: insert a fourth code segment into the machine intermediate representation language according to the fourth metadata tag, so as to utilize the fourth code segment to indicate the memory tag architecture and verify whether the tag of the memory area where the sensitive pointer variable is located is zero.

[0085] The fourth code segment is used to indicate the memory tag architecture and verify whether the tag of the memory area where the sensitive pointer variable is located is zero. For the implementation of the fourth code segment, refer to the description of the second code segment, which will not be repeated here.

[0086] In this embodiment, a third code segment is used to set the memory tag of a non-sensitive pointer variable to a second preset non-zero value. The memory tag of a sensitive pointer variable is set to a zero value by the memory tag architecture. Therefore, after the code in the target program and the code in the trusted third-party library modify the sensitive pointer variable, the memory tag of the sensitive pointer variable is still a zero value. When the verification result shows that the tag of the memory area where the sensitive pointer variable is located is a non-zero value, it is determined that the value of the sensitive pointer variable has been illegally tampered with, for example, illegal code hijacks the non-sensitive pointer variable to tamper with the sensitive pointer variable, so as to achieve the purpose of illegally accessing the memory area pointed to by the sensitive pointer variable. At this time, the memory exception protection function provided by the memory tag architecture can be used to throw an exception, prevent control flow hijacking attacks, and terminate the running target program.

[0087] Since the source code of the third-party library is missing, it is impossible to use the method provided by the present invention to obtain its semantic information and insert protection code. In the embodiment provided by the present invention, for non-sensitive pointer variables, after the instruction is written to them, the memory tag is set to a non-zero value; for sensitive pointer variables, before the instruction is read, the memory tag is checked to see if it is a zero value. Thus, the compatibility of the target program and the third-party library is achieved efficiently and at low cost, and protection for sensitive pointer variables is achieved.

[0088] The memory vulnerability protection device provided by the present invention is described below. The memory vulnerability protection device described below and the memory vulnerability protection method described above can be referenced to each other.

[0089] Figure 7 Schematic diagram of the structure of the memory vulnerability protection device provided by the present invention. Figure 7 As shown, the device 700 includes the following modules.

[0090] The analysis module 710 is used to perform semantic analysis on the target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture.

[0091] The stub module 720 is used to insert protection code for sensitive pointer variables in the intermediate representation language of the target program according to the pointer access context information, so as to utilize the protection code to implement memory vulnerability protection for the sensitive pointer variables during the running of the target program; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0092] Figure 8 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 8As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the memory vulnerability protection method, which includes: performing semantic analysis on the target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; according to the pointer access context information, inserting protection code for sensitive pointer variables in the intermediate representation language of the target program, so as to use the protection code during the running of the target program to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0093] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0094] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the memory vulnerability protection method provided by the above-mentioned methods, and the method includes: performing semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; according to the pointer access context information, inserting protection code for sensitive pointer variables into the intermediate representation language of the target program, so that during the running of the target program, the protection code is used to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0095] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the memory vulnerability protection method provided by the above-mentioned methods, the method comprising: performing semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; according to the pointer access context information, inserting protection code for sensitive pointer variables into the intermediate representation language of the target program, so that during the running of the target program, the protection code is utilized to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0096] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0097] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A memory vulnerability protection method, characterized in that: The method comprises: Performing semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; According to the pointer access context information, protection code for sensitive pointer variables is inserted into the intermediate representation language of the target program, so that during the running of the target program, the protection code is used to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

2. The memory vulnerability protection method according to claim 1, characterized in that: The intermediate representation language of the target program includes a compiler intermediate representation language and a machine intermediate representation language of the target program, wherein the compiler intermediate representation language is a pre-representation form of the machine intermediate representation language; The inserting protection code for the sensitive pointer variable into the intermediate representation language of the target program according to the pointer access context information comprises: Inserting a meta-information tag into the compiler intermediate representation language according to the pointer access context information; wherein the meta-information tag is used to indicate the location in the target program where the protection code is called; The protection code is inserted into the machine intermediate representation language according to the meta information tag.

3. The memory vulnerability protection method according to claim 2, characterized in that: The pointer access context information includes first context information for accessing a sensitive pointer variable, the meta information tag includes a first meta information tag and a second meta information tag, and the multiple code segments include a first code segment and a second code segment; The inserting the meta-information tag into the compiler intermediate representation language according to the pointer access context information comprises: Determine, according to the first context information, a first position of a write instruction and a second position of a read instruction for the sensitive pointer variable in the intermediate representation language of the compiler; inserting the first meta information tag according to the first position; inserting the second meta information tag according to the second position; The step of inserting the protection code into the machine intermediate representation language according to the meta-information tag comprises: According to the first meta-information tag, the first code segment is inserted into the machine intermediate representation language, so as to use the first code segment to instruct the memory tag architecture to set the tag of the memory area where the sensitive pointer variable is located to a first preset non-zero value; wherein the memory tag architecture is configured to: when storing data in the memory area, update the tag of the memory area to a zero value; According to the second meta-information tag, the second code segment is inserted into the machine intermediate representation language to utilize the second code segment to instruct the memory tag architecture to verify whether the label of the memory area where the sensitive pointer variable is located is the first preset non-zero value; wherein, when the verification result is that the label of the memory area is zero, it is determined that the value of the sensitive pointer variable has been tampered with.

4. The memory vulnerability protection method according to claim 3, characterized in that: The inserting the first code segment into the machine intermediate representation language according to the first meta-information tag, so as to use the first code segment to instruct the memory tag architecture to set the tag of the memory area where the sensitive pointer variable is located to a first preset non-zero value, comprises: inserting the first code segment into the machine intermediate representation language according to the first meta-information tag, so as to use the first code segment to instruct the memory tag architecture to set the tag of the memory area where the sensitive pointer variable is located to 1; The method of inserting the second code segment into the machine intermediate representation language according to the second meta-information tag, so as to use the second code segment to instruct the memory tag architecture to verify whether the tag of the memory area where the sensitive pointer variable is located is the first preset non-zero value, includes: According to the second meta-information tag, a second code segment is inserted into the machine intermediate representation language to utilize the second code segment to instruct the memory tag architecture to verify whether the tag of the memory area where the sensitive pointer variable is located is 1.

5. The memory vulnerability protection method according to claim 2, characterized in that: The pointer access context information includes first context information for accessing sensitive pointer variables and second context information for accessing non-sensitive pointer variables, the meta-information tag includes a third meta-information tag and a fourth meta-information tag, and the plurality of code segments also include a third code segment and a fourth code segment; The inserting the meta-information tag into the compiler intermediate representation language according to the pointer access context information comprises: Determine, according to the second context information, a third position of a write instruction for the non-sensitive pointer variable in the compiler intermediate representation language; After the third position, inserting the third meta information tag; Determine, according to the first context information, a fourth position of a read instruction for the sensitive pointer variable in the compiler intermediate representation language; Before the fourth position, insert the fourth meta-information tag; The step of inserting the protection code into the machine intermediate representation language according to the meta-information tag comprises: According to the third metadata tag, the third code segment is inserted into the machine intermediate representation language, so as to use the third code segment to instruct the memory tag architecture to set the tag of the memory area where the non-sensitive pointer variable is located to a second preset non-zero value; wherein the memory tag architecture is configured to: when storing data in the memory area, update the tag of the memory area to a zero value; According to the fourth metadata tag, the fourth code segment is inserted into the machine intermediate representation language to utilize the fourth code segment to instruct the memory tag architecture to verify whether the label of the memory area where the sensitive pointer variable is located is a zero value; wherein, when the verification result is that the label of the memory area is a non-zero value, it is determined that the value of the sensitive pointer variable has been tampered with.

6. The memory vulnerability protection method according to claim 3, characterized in that: The sensitive pointer variable is a class object pointer, and the protection code further includes a first anti-reuse code segment and a second anti-reuse code segment; The step of inserting protection code for sensitive pointer variables into the intermediate representation language of the target program according to the pointer access context information further includes: Determine, according to the first context information, a fifth position in the compiler intermediate representation language where the object corresponding to the sensitive pointer variable is instantiated; According to the fifth position, insert the first anti-reuse code segment to use the first anti-reuse code segment to assign an anti-reuse tag to the sensitive pointer variable; wherein the anti-reuse tag is passed to all virtual table pointers of the object through the constructor of the object; Determine, according to the first context information, in the compiler intermediate representation language, when the target virtual function is accessed by using the sensitive pointer variable, to obtain a sixth position of the virtual table pointer of the target virtual function; According to the sixth position, the second anti-reuse code segment is inserted to utilize the second anti-reuse code segment to determine whether the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are consistent; wherein, when the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are inconsistent, it is confirmed that the sensitive pointer variable is reused.

7. A memory vulnerability protection device, characterized in that: The device comprises: An analysis module, configured to perform semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor having a memory tag architecture; The stub module is used to insert protection code for sensitive pointer variables in the intermediate representation language of the target program according to the pointer access context information, so as to utilize the protection code to implement memory vulnerability protection for the sensitive pointer variables during the running of the target program; wherein the protection code includes a plurality of code segments implemented based on instructions provided by the memory tag architecture.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the memory vulnerability protection method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the memory vulnerability protection method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the memory vulnerability protection method according to any one of claims 1 to 6 is implemented.

Images