MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels

Abstract

Allocation, dereferencing, and freeing of memory data in kernels are coherently linked. There widely exist real cases where the correctness of memory is compromised. This incorrectness in kernel memory brings about signi ficant security issues, e.g., information leaking. Though memory allocation, dereferencing, and freeing are closely related, previous work failed to realize they are closely related. In this paper, we study the life-cycle of kernel memory, which consists of allocation, dereferencing, and freeing. Errors in them are called memory life-cycle (MLC) bugs. We propose an in-depth study of MLC bugs and implement a memory life-cycle bug sanitizer (MEBS) for MLC bug detection. Utilizing an inter-procedural global call graph and novel identi fication approaches, MEBS can reveal memory allocation, dereferencing, and freeing sites in kernels. By constructing a modi fied defi ne-use chain and examining the errors in the life-cycle, MLC bugs can be identifi ed. Moreover, the experimental results on the latest kernels demonstrate that MEBS can effectively detect MLC bugs, and MEBS can be scaled to different kernels. More than 100 new bugs are exposed in Linux and FreeBSD, and 12 common vulnerabilities and exposures (CVE) are assigned.

Publication
Journal of Computer Science and Technology (ISSN: 1000-9000),36(6): pp1248-1268, Nov. 2021.