Memory vulnerability protection method and device, electronic equipment and storage medium

Abstract

The application provides a memory vulnerability protection method and device, electronic equipment and storage medium, and relates to the technical field of computers. The memory vulnerability protection method comprises: performing semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory label architecture; and according to the pointer access context information, protection code for sensitive pointer variables is inserted into an intermediate representation language of the target program, so that the protection code is used to implement memory vulnerability protection for the sensitive pointer variables during the running of the target program; wherein the protection code comprises a plurality of code segments implemented based on instructions provided by the memory label architecture. The application can efficiently and comprehensively protect the memory for preventing memory vulnerabilities from being exploited.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a memory vulnerability protection method, device, electronic device, and storage medium. Background Art

[0002] In computer science, systems-level programming languages ​​(such as C / C++) are highly efficient and widely used in key areas such as system-level development and low-level drivers. However, the memory management features of systems-level programming languages ​​also pose significant security risks. Because systems-level programming languages ​​allow direct pointer access to memory with fewer restrictions and support arbitrary arithmetic operations and type conversions, this creates a significant imbalance between memory access flexibility and security. Furthermore, systems-level programming languages ​​lack explicit memory access bounds checking and native object lifecycle management mechanisms, further exacerbating the risk of memory vulnerabilities. Memory corruption vulnerabilities primarily fall into two categories: spatial memory corruption vulnerabilities, such as out-of-bounds access, and temporal memory corruption vulnerabilities, such as use-after-free. These vulnerabilities are common security threats in systems-level programming language programs. These vulnerabilities can not only cause program crashes but can also be exploited by malicious attackers to execute arbitrary code, seriously compromising system security and stability.

[0003] To address this challenge, the industry has proposed the innovative memory tagging architecture. The memory tagging architecture enhances memory representation capabilities at the hardware level, maintaining additional security metadata, known as memory tags, for each memory unit. Memory tags are dynamically updated as operations such as memory allocation, release, and access occur, and are efficiently updated and verified through a series of instructions. Compared to traditional software implementations, the memory tagging architecture offers significant performance advantages, and because memory tags are stored in an inaccessible location, it is more resilient to attacks targeting metadata. However, its high overhead and probabilistic nature limit its widespread adoption in actual business deployments.

[0004] Therefore, for system-level programming languages, how to perform efficient and comprehensive memory protection to prevent memory vulnerabilities from being exploited is a technical problem that needs to be solved urgently. Summary of the Invention

[0005] In response to the above-mentioned problems existing in the prior art, the present invention provides a memory vulnerability protection method, device, electronic device and storage medium to achieve efficient and comprehensive memory protection for system-level programming languages ​​to prevent memory vulnerabilities from being exploited.

[0006] The present invention provides a memory vulnerability protection method, comprising the following steps.

[0007] A target program is semantically analyzed to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; based on the pointer access context information, protection code for sensitive pointer variables is inserted into the intermediate representation language of the target program, so that during the running of the target program, the protection code is utilized to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0008] According to a memory vulnerability protection method provided by the present invention, the intermediate representation language of the target program includes the compiler intermediate representation language and the machine intermediate representation language of the target program, and the compiler intermediate representation language is a pre-representation form of the machine intermediate representation language; the protection code for the sensitive pointer variable is inserted into the intermediate representation language of the target program according to the pointer access context information, including: inserting a meta-information tag into the compiler intermediate representation language according to the pointer access context information; wherein the meta-information tag is used to indicate the location where the protection code is called in the target program; and inserting the protection code into the machine intermediate representation language according to the meta-information tag.

[0009] According to a memory vulnerability protection method provided by the present invention, the pointer access context information includes first context information for accessing a sensitive pointer variable, the meta-information tag includes a first meta-information tag and a second meta-information tag, and the multiple code segments include a first code segment and a second code segment; inserting the meta-information tag into the compiler intermediate representation language according to the pointer access context information includes: determining, according to the first context information, a first position of a write instruction and a second position of a read instruction for the sensitive pointer variable in the compiler intermediate representation language; inserting the first meta-information tag according to the first position; inserting the second meta-information tag according to the second position; inserting the meta-information tag into the machine intermediate representation language according to the meta-information tag The protection code includes: inserting the first code segment into the machine intermediate representation language according to the first metadata tag, so as to use the first code segment to instruct the memory tag architecture to set the tag of the memory area where the sensitive pointer variable is located to a first preset non-zero value; wherein the memory tag architecture is configured to: update the tag of the memory area to a zero value when storing data in the memory area; inserting the second code segment into the machine intermediate representation language according to the second metadata tag, so as to use the second code segment to instruct the memory tag architecture to verify whether the tag of the memory area where the sensitive pointer variable is located is the first preset non-zero value; wherein, if the verification result is that the tag of the memory area is zero, it is determined that the value of the sensitive pointer variable has been tampered with.

[0010] According to a memory vulnerability protection method provided by the present invention, according to the first metadata tag, the first code segment is inserted into the machine intermediate representation language to use the first code segment to indicate the memory tag architecture and set the label of the memory area where the sensitive pointer variable is located to a first preset non-zero value, including: according to the first metadata tag, the first code segment is inserted into the machine intermediate representation language to use the first code segment to indicate the memory tag architecture and set the label of the memory area where the sensitive pointer variable is located to 1; according to the second metadata tag, the second code segment is inserted into the machine intermediate representation language to use the second code segment to indicate the memory tag architecture and verify whether the label of the memory area where the sensitive pointer variable is located is the first preset non-zero value, including: according to the second metadata tag, the second code segment is inserted into the machine intermediate representation language to use the second code segment to indicate the memory tag architecture and verify whether the label of the memory area where the sensitive pointer variable is located is 1.

[0011] According to a memory vulnerability protection method provided by the present invention, the pointer access context information includes first context information for accessing sensitive pointer variables, and second context information for accessing non-sensitive pointer variables, the meta-information tag includes a third meta-information tag and a fourth meta-information tag, and the multiple code segments also include a third code segment and a fourth code segment; inserting the meta-information tag in the compiler intermediate representation language according to the pointer access context information includes: determining a third position of a write instruction for the non-sensitive pointer variable in the compiler intermediate representation language according to the second context information; inserting the third meta-information tag after the third position; determining a fourth position of a read instruction for the sensitive pointer variable in the compiler intermediate representation language according to the first context information; inserting the A fourth metadata tag; inserting the protection code into the machine intermediate representation language according to the metadata tag comprises: inserting the third code segment into the machine intermediate representation language according to the third metadata tag, so as to utilize the third code segment to instruct the memory tag architecture to set the label of the memory area where the non-sensitive pointer variable is located to a second preset non-zero value; wherein the memory tag architecture is configured to: update the label of the memory area to a zero value when storing data into the memory area; inserting the fourth code segment into the machine intermediate representation language according to the fourth metadata tag, so as to utilize the fourth code segment to instruct the memory tag architecture to verify whether the label of the memory area where the sensitive pointer variable is located is a zero value; wherein, if the verification result is that the label of the memory area is a non-zero value, it is determined that the value of the sensitive pointer variable has been tampered with.

[0012] According to a memory vulnerability protection method provided by the present invention, the sensitive pointer variable is a class object pointer, and the protection code further includes a first anti-reuse code segment and a second anti-reuse code segment. The method of inserting the protection code for the sensitive pointer variable into the intermediate representation language of the target program based on the pointer access context information further includes: determining, based on the first context information, a fifth location in the compiler intermediate representation language where the object corresponding to the sensitive pointer variable is instantiated; inserting the first anti-reuse code segment based on the fifth location, and using the first anti-reuse code segment to assign an anti-reuse tag to the sensitive pointer variable; wherein the anti-reuse tag is passed to all virtual table pointers of the object through the constructor of the object; determining, based on the first context information, a sixth location in the compiler intermediate representation language where the virtual table pointer of the target virtual function is obtained when the sensitive pointer variable is used to access the target virtual function; inserting the second anti-reuse code segment based on the sixth location, and using the second anti-reuse code segment to determine whether the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are consistent; wherein, if the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are inconsistent, confirming that the sensitive pointer variable is reused.

[0013] The present invention also provides a memory vulnerability protection device, comprising the following modules: an analysis module, used to perform semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; an insertion module, used to insert protection code for sensitive pointer variables in the intermediate representation language of the target program according to the pointer access context information, so as to utilize the protection code during the running of the target program to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-described memory vulnerability protection methods when executing the computer program.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described memory vulnerability protection methods.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned memory vulnerability protection methods.

[0017] The memory vulnerability protection method, device, electronic device, and storage medium provided by this invention perform semantic analysis on a target program to obtain pointer access context information. Based on this pointer access context information, protection code for sensitive pointer variables is inserted into the target program's intermediate representation language. By implementing multiple code segments based on instructions provided by a memory tag architecture, comprehensive protection against memory corruption vulnerabilities is achieved with minimal hardware overhead. This provides efficient and comprehensive memory protection for system-level programming languages, preventing memory vulnerabilities from being maliciously exploited. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 This is one of the flow charts of the memory vulnerability protection method provided by the present invention.

[0020] Figure 2 This is the second flow chart of the memory vulnerability protection method provided by the present invention.

[0021] Figure 3 This is the third flow chart of the memory vulnerability protection method provided by the present invention.

[0022] Figure 4 This is the fourth flow chart of the memory vulnerability protection method provided by the present invention.

[0023] Figure 5 This is a schematic diagram of the effect of the memory vulnerability protection method provided by the present invention.

[0024] Figure 6 It is a schematic diagram of the implementation process of the memory vulnerability protection method provided by the present invention.

[0025] Figure 7 It is a structural diagram of the memory vulnerability protection device provided by the present invention.

[0026] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0027] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0028] To address the inadequate performance of source detection against memory corruption vulnerabilities, this paper proposes a method for exploiting memory corruption vulnerabilities to protect programs. Among the many attack methods, control flow hijacking attacks are particularly common. These attacks exploit memory corruption vulnerabilities to tamper with code pointers in memory, thereby hijacking the program's control flow, potentially leading to serious consequences such as remote code execution.

[0029] Control flow refers to the order of instructions during program execution. In system-level programming languages ​​(such as C / C++), control flow is not only influenced by conditional statements and loops but also strongly depends on pointer values ​​in memory. Control flow transfer in system-level programming languages ​​is primarily categorized as forward control flow transfer (such as indirect calls and jumps using function pointers) and backward control flow transfer (such as returns using return addresses). Both transfer methods rely on function pointers and return addresses stored explicitly in memory, which can be accessed and modified through pointers.

[0030] If an attacker attempts to hijack control flow by exploiting a memory corruption vulnerability, they must tamper with or reuse a critical pointer that affects control flow. Pointer tampering occurs when a pointer is modified by an instruction that is not permitted by the program semantics. For example, due to a memory vulnerability, a pointer is overwritten by a store instruction that should not access it. Pointer reuse occurs when a pointer is reused in an illegal context. For example, a dangling pointer is used to access memory after the object it originally pointed to is released, potentially accessing memory objects that should not be accessed.

[0031] The following combination Figures 1-6 The memory vulnerability protection method of the present invention is described.

[0032] Figure 1 This is one of the flow charts of the memory vulnerability protection method provided by the present invention, such as Figure 1 As shown, the method includes the following:

[0033] Step 101: Perform semantic analysis on the target program to obtain pointer access context information in the target program.

[0034] The target program is a program implemented in a system-level programming language that contains sensitive pointer variables and needs to protect the sensitive pointer variables. The target program runs on a processor with a memory tag architecture.

[0035] Sensitive pointer variables are those used when processing sensitive data or performing critical tasks. Due to their special uses, these pointer variables require extra security attention and protection.

[0036] The memory tag architecture is a security technology that combines software and hardware. It sets memory tags for data stored in memory based on instructions. These memory tags are stored in the memory area along with the data as additional security metadata. At the same time, the memory tag architecture also provides a memory tag verification mechanism that can verify the memory tags of data stored in memory based on instructions. In some embodiments, the memory tag architecture can provide memory tags of multiple granularities, such as 1-bit memory tags or 4-bit memory tags.

[0037] During specific implementation, the memory tag architecture can be implemented in a variety of ways and is not limited to the description in this specification.

[0038] Pointer access context information is various information and states closely related to pointer access operations during program execution, such as the pointer's source, target address, access type, and surrounding code logic.

[0039] In practice, the program analysis module is implemented through deep customization and functional expansion of the LLVM (Low Level Virtual Machine). This module captures key semantic details of pointer accesses from the target program's source code and LLVM intermediate representation, such as the specific location of a virtual table pointer for an object in the target program. It also extracts important semantic information such as variable types from the LLVM intermediate representation.

[0040] Step 102: insert protection code for sensitive pointer variables into the intermediate representation language of the target program according to the pointer access context information, so as to implement memory vulnerability protection for sensitive pointer variables by utilizing the protection code during the running of the target program.

[0041] The intermediate representation language of the target program includes the compiler intermediate representation language and the machine intermediate representation language of the target program. The compiler intermediate representation language is the pre-representation form of the machine intermediate representation language.

[0042] The protected code consists of multiple code segments implemented based on instructions provided by the memory tag architecture.

[0043] Since the instructions provided by the memory tag architecture are instructions for the underlying hardware (for example, assembly instructions), they cannot be directly called and executed in the target program implemented in the system-level language. They need to be inserted into the machine intermediate representation language to enable the instructions provided by the memory tag architecture to be called during the execution of the target program.

[0044] In some embodiments, a meta-information tag is inserted into the compiler intermediate representation language based on pointer access context information; wherein the meta-information tag is used to indicate the location where the protection code is called in the target program; and based on the meta-information tag, the protection code is inserted into the machine intermediate representation language.

[0045] Meta-information tags are special tags used in the machine intermediate representation (IR) to instruct the compiler to insert a specific code segment at a specific location. The specific syntax and purpose of these tags vary across compilers and IR designs. For example, a meta-information tag might be [xx_insert], which instructs the compiler to insert a specific code segment at a specific location during a certain phase.

[0046] In the specific implementation process, this step can be performed using a program instrumentation module. The program instrumentation module inserts protection code into the intermediate representation language of the target program based on pointer access context information to achieve seamless integration with the memory tag architecture while ensuring that the integrity of the target program's functions is not affected.

[0047] In the specific implementation process, the protection code also includes functions in the runtime library. The runtime library provides a series of helper functions that can assist in the update and labeling of memory tags. Figure 6 As shown, the runtime library is linked to the binary executable file of the target program. When the target program is running, it assists the target program in interacting with the memory tag architecture.

[0048] In the specific implementation process, protection codes can be used in various ways to implement memory vulnerability protection for sensitive pointer variables, which is not limited by the description of this specification.

[0049] For multiple implementations of using protection code to implement memory vulnerability protection for sensitive pointer variables, see Figure 2 、 Figure 3 as well as Figure 4 The relevant content in will not be repeated here.

[0050] Figure 2 This is the second flow chart of the memory vulnerability protection method provided by the present invention.

[0051] In this embodiment, the pointer access context information includes first context information for accessing sensitive pointer variables, the meta information tag includes a first meta information tag and a second meta information tag, and the multiple code segments include a first code segment and a second code segment. Figure 2 As shown, the method includes the following:

[0052] Step 201: Determine, based on first context information, a first location of a write instruction and a second location of a read instruction for a sensitive pointer variable in an intermediate representation language of a compiler.

[0053] The first context information includes context information of a write instruction or a read instruction for a sensitive pointer variable. Based on the first context information, the first position of the write instruction and the second position of the read instruction for the sensitive pointer variable in the intermediate representation language of the compiler can be determined.

[0054] Step 202: Insert a first metadata tag according to the first position.

[0055] Step 203: insert a second metadata tag according to the second position.

[0056] Step 204: insert a first code segment into the machine intermediate representation language according to the first metadata tag, and use the first code segment to instruct the memory tag architecture to set the tag of the memory area where the sensitive pointer variable is located to a first preset non-zero value.

[0057] The first code segment includes an assembly instruction that instructs the memory tag architecture to set the label of the memory region where the sensitive pointer variable is located to a first preset non-zero value. This code segment not only includes instructions provided by the memory tag architecture specifically for modifying the label of a specified memory region, but also includes instructions for preparing the registers required to execute this instruction. Specifically, these registers include a register for storing the starting address of the memory region whose label is to be modified (for example, register A) and another register for storing the first preset non-zero value (for example, register B).

[0058] Just as an example, pseudocode for the first code snippet looks like this:

[0059] "; Load the starting address of the memory area storing sensitive pointer variables into register A

[0060] MOV A, [the starting address of the memory area where sensitive pointer variables are stored]

[0061] ; Load the first preset non-zero value into register B

[0062] MOV B, first preset non-zero value

[0063] ; Use specific instructions (e.g., SET_TAG) to modify the tag of a memory region

[0064] SET_TAG A, B".

[0065] In this embodiment, the memory tag architecture is configured to update the tag of a memory region to a value of zero when data is stored in the memory region. Therefore, when the processor executes a store instruction for data in the memory region, the memory tag architecture simultaneously updates the tag of the memory region to a value of zero. Because the first code segment is inserted at the first position of the write instruction for the sensitive pointer variable, after the target program modifies the sensitive pointer variable, the tag of the memory region storing the sensitive pointer variable is a first preset non-zero value; and after code in the non-target program modifies the sensitive pointer variable, the tag of the memory region storing the sensitive pointer variable is a value of zero.

[0066] In a specific implementation, the first preset non-zero value can be set according to actual application conditions and is not limited to the description of this specification. For example, if the memory tag occupies 2 bits, the first preset non-zero value can be a value of 1 (binary 01), 2 (binary 10), or 3 (binary 11).

[0067] In some embodiments, the memory tag architecture provides a 1-bit memory tag for each machine word in the memory, and the first preset non-zero value is 1. The first code segment instructs the memory tag architecture to set the tag of the memory region where the sensitive pointer variable is located to 1.

[0068] Step 205: Insert a second code segment into the machine intermediate representation language according to the second metadata tag, so as to utilize the second code segment to indicate the memory tag architecture and verify whether the tag of the memory area where the sensitive pointer variable is located is a first preset non-zero value.

[0069] The second code segment includes an assembly instruction that instructs the memory tag architecture to verify that the tag of the memory region containing the sensitive pointer variable is a first, predefined, non-zero value. This code segment not only includes instructions specifically provided by the memory tag architecture for verifying the tag of the specified memory region, but also includes instructions for preparing the registers required to execute this instruction. For example, the second code segment is shown below:

[0070] "; Assume that the sensitive pointer variable is stored in register R1, and the memory tag architecture is configured so that when data is loaded from the memory area to the register, the tag of the memory area is also loaded. Therefore, register R1 also stores the memory tag corresponding to the sensitive pointer variable.

[0071] ; Assume that the first preset non-zero value is stored in register R2

[0072] ; Assume the memory tag verification instruction is VERIFY_TAG, which accepts two parameters: memory address (R1) and the first preset non-zero value (R2)

[0073] ; Set R2 to the first preset non-zero value

[0074] MOV R2, #0x02 ; Here 0x02 is the first preset non-zero value

[0075] ; Call memory tag verification instruction

[0076] VERIFY_TAG R1, R2; Verify that the tag stored in R1 is the same as the value in R2".

[0077] If the verification result shows that the tag of the memory area is zero, it is determined that the value of the sensitive pointer variable has been tampered with. Figure 5 As shown, the memory exception protection function provided by the memory tag architecture can be used to throw exceptions, prevent control flow hijacking attacks, and terminate the running target program.

[0078] In some embodiments, the memory tag architecture provides a 1-bit memory tag for each machine word in the memory, and the first preset non-zero value is 1. The second code segment instructs the memory tag architecture to verify whether the tag of the memory region where the sensitive pointer variable is located is 1.

[0079] The memory vulnerability protection method from steps 201 to 205 provides a high level of protection for sensitive pointer variables, allowing only instructions within the target program to modify them. However, in actual applications, target programs often need to link with third-party libraries. Due to the limitations of the aforementioned memory vulnerability protection method, it does not allow code in third-party libraries to directly modify sensitive pointer variables in the target program. Therefore, this method is suitable for scenarios where the target program is linked with untrusted third-party libraries.

[0080] For memory vulnerability protection methods for scenarios linked with trusted third-party libraries, see Figure 4 The relevant content in will not be repeated here.

[0081] Figure 3 This is the third flow chart of the memory vulnerability protection method provided by the present invention.

[0082] In this embodiment, the sensitive pointer variable is a class object pointer, and the protection code further includes a first anti-reuse code segment, a second anti-reuse code segment, an anti-restore tag, an anti-restore tag, and an anti-restore tag.

[0083] like Figure 3 As shown, the method includes the following:

[0084] Step 301: Determine, based on the first context information, a fifth location in the compiler intermediate representation language where the object corresponding to the sensitive pointer variable is instantiated.

[0085] Step 302: Insert the first anti-reuse code segment according to the fifth position, and use the first anti-reuse code segment to assign an anti-reuse tag to the sensitive pointer variable.

[0086] The first anti-reuse code segment is used to assign an anti-reuse tag to a sensitive pointer variable. The anti-reuse tag is stored in the high-order bits of the pointer (e.g., the upper 4 bits). Only a limited number of low-order bits of the pointer are involved in address resolution. Modifying the pointer's high-order bits does not affect the normal resolution of the pointer address. The anti-reuse tag is passed to all virtual table pointers of the object corresponding to the sensitive pointer variable through the constructor of the object.

[0087] Step 303: Determine, based on the first context information, in the compiler intermediate representation language, the sixth position of the virtual table pointer of the target virtual function when the sensitive pointer variable is used to access the target virtual function.

[0088] The vtable pointer is a hidden pointer member variable that exists in every object of a class that contains virtual functions. It points to the class's virtual function table (also known as the vtable), which stores the addresses of each virtual function in the class. When a sensitive pointer variable calls a target virtual function, the system retrieves the object's vtable pointer and uses the current location as the sixth position.

[0089] Step 304: insert a second anti-reuse code segment according to the sixth position, and use the second anti-reuse code segment to determine whether the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are consistent.

[0090] The second anti-reuse code segment is used to determine whether the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are consistent. When the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are inconsistent, it means that the virtual table pointer now points to a completely different object or memory area, which may not contain the expected virtual table or contain a maliciously constructed virtual table. In this case, if a virtual function is called through the virtual table pointer, undefined behavior or security vulnerabilities may be triggered. Therefore, when the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are inconsistent, it is confirmed that the sensitive pointer variable is reused. At this time, if Figure 5 As shown, the function in the runtime library can be called to throw an exception, prevent the control flow hijacking attack, and terminate the running target program.

[0091] Figure 4 This is the fourth flow chart of the memory vulnerability protection method provided by the present invention.

[0092] In this embodiment, the pointer access context information includes first context information for accessing sensitive pointer variables and second context information for accessing non-sensitive pointer variables, the meta-information tag includes a third meta-information tag and a fourth meta-information tag, and the plurality of code segments further includes a third code segment and a fourth code segment. Figure 4 As shown, the method includes the following:

[0093] Step 401: Determine, based on the second context information, a third position of a write instruction for a non-sensitive pointer variable in the compiler intermediate representation language.

[0094] Non-sensitive pointer variables are pointers that do not point to sensitive data. Non-sensitive pointer variables may point to ordinary data structures, buffers, file descriptors, etc., which do not contain or involve sensitive information.

[0095] Step 402: Insert a third metadata tag after the third position.

[0096] Step 403: Determine, according to the first context information, a fourth position of a read instruction for the sensitive pointer variable in the compiler intermediate representation language.

[0097] Step 404: Insert a fourth metadata tag before the fourth position.

[0098] Step 405: insert a third code segment into the machine intermediate representation language according to the third metadata tag, and use the third code segment to instruct the memory tag architecture to set the tag of the memory area where the non-sensitive pointer variable is located to a second preset non-zero value.

[0099] The third code segment is used to indicate the memory tag architecture and set the tag of the memory region where the non-sensitive pointer variable is located to a second predetermined non-zero value (e.g., 1). For the implementation of the third code segment, refer to the description of the first code segment and will not be repeated here.

[0100] The memory tag architecture is configured to update the tag of the memory region to a value of zero when storing data in the memory region. Therefore, in this embodiment, the tag of the memory region where the non-sensitive pointer variable is located is a second predetermined non-zero value, and the tag values ​​of the remaining memory regions are zero.

[0101] Step 406: insert a fourth code segment into the machine intermediate representation language according to the fourth metadata tag, so as to utilize the fourth code segment to indicate the memory tag architecture and verify whether the tag of the memory area where the sensitive pointer variable is located is zero.

[0102] The fourth code segment is used to indicate the memory tag architecture and verify whether the tag of the memory region where the sensitive pointer variable is located is zero. For the implementation of the fourth code segment, please refer to the description of the second code segment and will not be repeated here.

[0103] In this embodiment, a third code segment is used to set the memory tag of a non-sensitive pointer variable to a second preset non-zero value. The memory tag of the sensitive pointer variable is set to a zero value by the memory tag architecture. Therefore, after the code in the target program and the code in the trusted third-party library modify the sensitive pointer variable, the memory tag of the sensitive pointer variable is still a zero value. When the verification result shows that the label of the memory area where the sensitive pointer variable is located is a non-zero value, it is determined that the value of the sensitive pointer variable has been illegally tampered with. For example, illegal code hijacks the non-sensitive pointer variable to tamper with the sensitive pointer variable, so as to achieve the purpose of illegally accessing the memory area pointed to by the sensitive pointer variable. At this time, the memory exception protection function provided by the memory tag architecture can be used to throw an exception, prevent control flow hijacking attacks, and terminate the running target program.

[0104] Because the source code of the third-party library is missing, the method provided by this invention cannot be used to obtain its semantic information and insert protection code. In the embodiments provided by this invention, for non-sensitive pointer variables, their memory tags are set to non-zero values ​​after an instruction is written to them; for sensitive pointer variables, their memory tags are checked to see if they are zero before an instruction is read from them. This effectively and cost-effectively achieves compatibility between the target program and the third-party library, while also providing protection for sensitive pointer variables.

[0105] The memory vulnerability protection device provided by the present invention is described below. The memory vulnerability protection device described below and the memory vulnerability protection method described above can be referenced to each other.

[0106] Figure 7 This is a schematic diagram of the structure of the memory vulnerability protection device provided by the present invention. Figure 7 As shown, the device 700 includes the following modules.

[0107] The analysis module 710 is configured to perform semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture.

[0108] The insertion module 720 is used to insert protection code for sensitive pointer variables into the intermediate representation language of the target program based on the pointer access context information, so as to utilize the protection code to implement memory vulnerability protection for the sensitive pointer variables during the operation of the target program; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0109] Figure 8 An example of a physical structure diagram of an electronic device is shown below. Figure 8As shown, the electronic device may include: a processor 810, a communications interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call logic instructions in the memory 830 to execute a memory vulnerability protection method, which includes: performing semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; and inserting protection code for sensitive pointer variables into the intermediate representation language of the target program based on the pointer access context information, so that during the execution of the target program, the protection code is used to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0110] Furthermore, the logic instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0111] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the memory vulnerability protection method provided by the above-mentioned methods, and the method includes: performing semantic analysis on the target program to obtain pointer access context information in the target program; wherein, the target program runs on a processor with a memory tag architecture; according to the pointer access context information, inserting protection code for sensitive pointer variables into the intermediate representation language of the target program, so that during the running of the target program, the protection code is used to implement memory vulnerability protection for the sensitive pointer variables; wherein, the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0112] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the memory vulnerability protection method provided by the above-mentioned methods, the method comprising: performing semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; based on the pointer access context information, inserting protection code for sensitive pointer variables into the intermediate representation language of the target program, so that during the running of the target program, the protection code is utilized to implement memory vulnerability protection for the sensitive pointer variables; wherein the protection code includes multiple code segments implemented based on instructions provided by the memory tag architecture.

[0113] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0114] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A memory vulnerability protection method, characterized in that: The method comprises: Performing semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor with a memory tag architecture; Inserting protection code for sensitive pointer variables into the intermediate representation language of the target program based on the pointer access context information, so as to implement memory vulnerability protection for the sensitive pointer variables using the protection code during the execution of the target program; wherein the protection code includes a plurality of code segments implemented based on instructions provided by the memory tag architecture; The intermediate representation language of the target program includes a compiler intermediate representation language and a machine intermediate representation language of the target program, and the compiler intermediate representation language is a pre-representation form of the machine intermediate representation language; The inserting protection code for sensitive pointer variables into the intermediate representation language of the target program according to the pointer access context information includes: Inserting a meta-information tag into the compiler intermediate representation language according to the pointer access context information; wherein the meta-information tag is used to indicate a location in the target program where the protection code is called; The protection code is inserted into the machine intermediate representation language according to the meta information tag.

2. The memory vulnerability protection method according to claim 1, characterized in that: The pointer access context information includes first context information for accessing a sensitive pointer variable, the meta information tag includes a first meta information tag and a second meta information tag, and the multiple code segments include a first code segment and a second code segment; The inserting the meta-information tag into the compiler intermediate representation language according to the pointer access context information comprises: Determining, according to the first context information, a first location of a write instruction and a second location of a read instruction for the sensitive pointer variable in the compiler intermediate representation language; inserting the first meta information tag according to the first position; inserting the second meta-information tag according to the second position; The step of inserting the protection code into the machine intermediate representation language according to the meta-information tag comprises: inserting the first code segment into the machine intermediate representation language according to the first metadata tag, so as to instruct the memory tag architecture to set the tag of the memory region where the sensitive pointer variable is located to a first preset non-zero value using the first code segment; wherein the memory tag architecture is configured to update the tag of the memory region to a zero value when storing data in the memory region; According to the second metadata tag, the second code segment is inserted into the machine intermediate representation language to utilize the second code segment to instruct the memory tag architecture to verify whether the label of the memory area where the sensitive pointer variable is located is the first preset non-zero value; wherein, if the verification result is that the label of the memory area is zero, it is determined that the value of the sensitive pointer variable has been tampered with.

3. The memory vulnerability protection method according to claim 2, characterized in that: The step of inserting the first code segment into the machine intermediate representation language according to the first metadata tag, and using the first code segment to instruct the memory tag architecture to set the tag of the memory region where the sensitive pointer variable is located to a first preset non-zero value, includes: inserting the first code segment into the machine intermediate representation language according to the first metadata tag, so as to use the first code segment to instruct the memory tag architecture to set the tag of the memory region where the sensitive pointer variable is located to 1; The method of inserting the second code segment into the machine intermediate representation language according to the second metadata tag, and using the second code segment to instruct the memory tag architecture to verify whether the tag of the memory region where the sensitive pointer variable is located is the first preset non-zero value, includes: According to the second metadata tag, a second code segment is inserted into the machine intermediate representation language to utilize the second code segment to instruct the memory tag architecture to verify whether the tag of the memory area where the sensitive pointer variable is located is 1.

4. The memory vulnerability protection method according to claim 1, wherein: The pointer access context information includes first context information for accessing a sensitive pointer variable and second context information for accessing a non-sensitive pointer variable, the meta-information tag includes a third meta-information tag and a fourth meta-information tag, and the plurality of code segments further include a third code segment and a fourth code segment; The inserting the meta-information tag into the compiler intermediate representation language according to the pointer access context information comprises: determining, according to the second context information, a third position of a write instruction for the non-sensitive pointer variable in the compiler intermediate representation language; After the third position, inserting the third meta-information tag; Determining, according to the first context information, a fourth position of a read instruction for the sensitive pointer variable in the compiler intermediate representation language; inserting the fourth meta-information tag before the fourth position; The step of inserting the protection code into the machine intermediate representation language according to the meta-information tag comprises: inserting the third code segment into the machine intermediate representation language according to the third metadata tag, so as to instruct the memory tag architecture to set the tag of the memory region where the non-sensitive pointer variable is located to a second preset non-zero value by using the third code segment; wherein the memory tag architecture is configured to: update the tag of the memory region to a zero value when storing data in the memory region; According to the fourth metadata tag, the fourth code segment is inserted into the machine intermediate representation language to utilize the fourth code segment to instruct the memory tag architecture to verify whether the label of the memory area where the sensitive pointer variable is located is a zero value; wherein, if the verification result is that the label of the memory area is a non-zero value, it is determined that the value of the sensitive pointer variable has been tampered with.

5. The memory vulnerability protection method according to claim 2, characterized in that: The sensitive pointer variable is a class object pointer, and the protection code further includes a first anti-reuse code segment and a second anti-reuse code segment; The step of inserting protection code for sensitive pointer variables into the intermediate representation language of the target program according to the pointer access context information further includes: determining, based on the first context information, a fifth location in the compiler intermediate representation language where the object corresponding to the sensitive pointer variable is instantiated; inserting the first anti-reuse code segment according to the fifth position, so as to assign an anti-reuse tag to the sensitive pointer variable using the first anti-reuse code segment; wherein the anti-reuse tag is passed to all virtual table pointers of the object through the constructor of the object; determining, according to the first context information, in the compiler intermediate representation language, a sixth position of a virtual table pointer of the target virtual function when the sensitive pointer variable is used to access the target virtual function; According to the sixth position, the second anti-reuse code segment is inserted to use the second anti-reuse code segment to determine whether the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are consistent; wherein, when the anti-reuse tags of the sensitive pointer variable and the virtual table pointer are inconsistent, it is confirmed that the sensitive pointer variable is reused.

6. A memory vulnerability protection device, characterized in that: The device comprises: An analysis module, configured to perform semantic analysis on a target program to obtain pointer access context information in the target program; wherein the target program runs on a processor having a memory tag architecture; an instrumentation module, configured to insert protection code for sensitive pointer variables into the intermediate representation language of the target program based on the pointer access context information, so as to implement memory vulnerability protection for the sensitive pointer variables using the protection code during the execution of the target program; wherein the protection code includes a plurality of code segments implemented based on instructions provided by the memory tag architecture; The intermediate representation language of the target program includes a compiler intermediate representation language and a machine intermediate representation language of the target program, and the compiler intermediate representation language is a pre-representation form of the machine intermediate representation language; The inserting protection code for sensitive pointer variables into the intermediate representation language of the target program according to the pointer access context information includes: Inserting a meta-information tag into the compiler intermediate representation language according to the pointer access context information; wherein the meta-information tag is used to indicate a location in the target program where the protection code is called; The protection code is inserted into the machine intermediate representation language according to the meta information tag.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the memory vulnerability protection method according to any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the memory vulnerability protection method according to any one of claims 1 to 5 is implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the memory vulnerability protection method according to any one of claims 1 to 5 is implemented.

Images