Virtual Table Cookie Checks for Use-After-Free Vulnerabilities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Programs written in languages lacking sound object lifetime management facilities are susceptible to 'use-after-free' vulnerabilities, where objects are prematurely freed and subsequently accessed, leading to object corruption and potential malicious code execution.
Innovation Solution
Incorporating instrumentation checks to verify the integrity of objects before method or field access by adding a secret cookie to the virtual function table at compile time, ensuring that only valid access is allowed by comparing the cookie's value against a known expected value, and checking if the virtual table pointer is within the legitimate module bounds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If instrumentation checks are added to verify object integrity before access, then security against object corruption is improved, but program execution overhead increases
Solution Approach 1:
The patent applies preliminary action by inserting instrumentation checks at the beginning of virtual method calls and field accesses to verify object integrity before the actual access occurs. The checks validate the virtual table pointer and secret cookie values in advance, preventing corrupted objects from being accessed while maintaining security. This preliminary verification approach ensures that security checks are performed at the earliest possible point in the execution flow.
2Reliability
If secret cookies are embedded in virtual function tables to prevent corruption, then object integrity verification is improved, but device complexity increases
Solution Approach 1:
The patent uses secret cookies as intermediary values embedded in the virtual function tables to mediate the verification process. These cookies act as hidden tokens that the instrumentation checks compare against expected values to determine object integrity. The intermediary mechanism allows the system to verify object authenticity without requiring complex cryptographic protocols or additional authentication infrastructure, thereby limiting the increase in system complexity.
Solution Approach 2:
The patent applies parameter changes by modifying the virtual function table structure to include secret cookie parameters. The instrumentation checks alter the execution flow based on the values of these parameters, terminating access when cookie values do not match expected values. This parameter-based verification approach provides a relatively simple mechanism for integrity checking compared to more complex security architectures.
3Object-affected harmful factors
If virtual table pointer validation is performed to detect fake virtual function tables, then protection against malicious code execution is improved, but program execution speed decreases
Solution Approach 1:
The patent applies preliminary anti-action by performing validation checks on virtual table pointers before malicious code can be executed. The instrumentation checks verify that the virtual table pointer points to a legitimate location and that the secret cookie values match expected values, preventing fake virtual function tables from being used. This preliminary defensive action blocks malicious execution paths before they can cause harm, addressing the security concern proactively.
Data Source
AI summary
The subject disclosure is directed towards preventing the exploitation by malicious code of object state corruption vulnerabilities, such as use-after-free vulnerabilities. An object class is configured with a secret cookie in a virtual function table of the object, e.g., inserted at compile time. An instrumentation check inserted in the program code evaluates the secret cookie to determine whether the object state has been corrupted before object access (e.g., a call to one of the object's methods) is allowed. If corrupted, access to the object is prevented by the instrumentation check. Another instrumentation check may be used to determine whether the object's virtual table pointer points to a location outside of the module that contains the legitimate virtual function table; if so, object access is prevented.