Quarantine-Based Garbage Collection for Use-After-Free Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low-level languages like C and C++ face challenges in implementing effective garbage collection due to performance overhead, leading to vulnerabilities such as memory leaks and use-after-free issues, which can be exploited for attacks.
Innovation Solution
A garbage collection method and apparatus that utilizes a CSR_quarantined_chunks register to track dynamically allocated memory areas, identifying and quarantining those with dangling pointers, and reallocating memory areas without them by using a quarantine list and a free list.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If garbage collection is implemented in low-level languages like C or C++, then security against use-after-free vulnerabilities is improved, but performance overhead increases
Solution Approach 1:
The patent applies preliminary action by inserting deallocated memory areas into a quarantine list immediately when freed, before any potential dangling pointer access can occur. This proactive approach prevents use-after-free vulnerabilities by ensuring that freed memory is isolated and tracked, allowing the system to detect and prevent unauthorized access while maintaining acceptable performance through targeted monitoring rather than comprehensive garbage collection overhead.
2Productivity
If explicit memory deallocation is used in low-level languages, then performance overhead is reduced, but vulnerabilities such as use-after-free and memory leaks increase
Solution Approach 1:
The patent introduces an intermediary mechanism - the quarantine list - that sits between explicit memory deallocation and actual memory reuse. When memory is freed through free() or delete, it is automatically inserted into the quarantine list rather than being immediately returned to the free pool. This intermediary structure allows the system to maintain explicit deallocation performance while adding automated tracking and protection against use-after-free vulnerabilities, effectively bridging the gap between performance and security.
3Reliability
If all dynamically allocated memory areas are tracked for garbage collection, then security is improved, but device complexity increases
Solution Approach 1:
The patent applies segmentation by dividing memory management into distinct segments: actively allocated memory, quarantined freed memory, and permanently freed memory. The quarantine list creates a separate segment for recently freed memory areas that may still be referenced by dangling pointers. This segmentation allows the system to apply enhanced tracking and protection only where necessary (in the quarantine segment) while maintaining standard management for other segments, thereby improving security without proportionally increasing overall system complexity.
Data Source
AI summary
Disclosed herein are a garbage collection method and apparatus. The garbage collection method includes when an area dynamically allocated through a malloc( ) function or a new operator of a standard C library is deallocated through a free( ) function or a delete operator, inserting the deallocated area into a quarantine list, recording a base address and an end address of each of areas inserted into the quarantine list in a CSR_quarantined_chunks register, finding a physical address of a memory page used by a processor and searching data in the memory page for a value included in a quarantined area of the CSR_quarantined_chunks register, when a value included in the quarantined area is not present, setting a state flag bit of the register to 0, and deleting an area which the state flag bit is 0 from the quarantine list, and inserting the area into a free list.