Shadow Memory Replay for Use-After-Free Root Cause Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying the root cause of use-after-free memory corruption bugs is challenging due to limited detection capabilities in existing debugging systems, which can lead to inconsistent behavior and security vulnerabilities.
Innovation Solution
A system comprising a deployed software computing device and a replay computing device that records and replays program execution, using an LRU memory allocation algorithm to filter potential root causes by comparing memory address accesses and generating a candidate list for root cause identification, thereby reducing false positives and simplifying the debugging process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If common software testing techniques are used to detect use-after-free bugs, then the detection process is simple, but the bugs cannot be detected because the device continues to execute
Solution Approach 1:
The system performs preliminary actions by allocating shadow memory blocks before the actual memory is freed, and sets up shadow memory management structures in advance. This allows the system to track memory accesses after free without interfering with normal program execution, enabling detection of use-after-free bugs that would otherwise go undetected.
Solution Approach 2:
The patent introduces shadow memory as an intermediary layer between the actual memory and the processor. This shadow memory block mirrors the freed memory block and intercepts any subsequent accesses to the freed memory, allowing detection of use-after-free bugs without modifying the original program logic or causing execution crashes.
2Measurement precision
If debugging systems permit catching use-after-free bugs, then bug detection is achieved, but root cause identification is significantly limited or entirely absent
Solution Approach 1:
The system performs preliminary actions by allocating shadow memory blocks before the actual memory is freed, and sets up shadow memory management structures in advance. This allows the system to track memory accesses after free without interfering with normal program execution, enabling detection of use-after-free bugs that would otherwise go undetected.
Solution Approach 2:
The system implements feedback mechanisms by monitoring memory access patterns in the shadow memory block and comparing them against the freed memory block's access history. This feedback loop enables the system to identify not just that a use-after-free bug occurred, but specifically which memory access operations contributed to the bug, providing precise root cause identification.
3Reliability
If all memory address accesses are recorded for root cause analysis, then comprehensive bug detection is achieved, but false positives increase and debugging effort increases
Solution Approach 1:
The patent extracts only the relevant memory address accesses from the complete execution trace by comparing shadow memory block accesses against the freed memory block's access history. This extraction process filters out irrelevant memory operations and focuses only on those that could potentially cause use-after-free bugs, reducing false positives and debugging time.
Solution Approach 2:
The system applies local quality by focusing analysis resources on specific memory blocks that have been freed and their corresponding shadow memory blocks, rather than analyzing all memory accesses in the program. This localized approach to quality control enables precise identification of problematic memory operations without the overhead of comprehensive global analysis.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Technologies for identification of a potential root cause of a use-after-free memory corruption bug of a program include a computing device to replay execution of the execution of the program based on an execution log of the program. The execution log comprises an ordered set of executed instructions of the program that resulted in the use-after-free memory corruption bug. The computing device compares a use-after-free memory address access of the program to a memory address associated with an occurrence of the use-after-free memory corruption bug in response to detecting the use-after-free memory address access and records the use-after-free memory address access of the program as a candidate for a root cause of the use-after-free memory corruption bug to a candidate list in response to detecting a match between the use-after-free memory address access of the program and the memory address associated with the occurrence of the use-after-free memory corruption bug.