Low-Level Software Security for Compiler Developers

https://llsoftsec.github.io/llsoftsecbook/#introduction

by signa11 • 3 years ago

78 17 3 years ago

llsoftsec.github.io

pflanze• 3 years ago

There was some discussion two days ago: https://news.ycombinator.com/item?id=34845954

rkagerer• 3 years ago

This is an interesting overview.

It mentions, regarding sanitizers (and presumably other safety tooling): "They are often too expensive to run in production mode, as they tend to increase execution time and memory usage."

I'm surprised we don't have better, performance-neutral hardware support for safety constructs like bounds checking.

Legacy x86 had a BOUND instruction but apparently it sucked and was so little used AMD didn't even bother to implement it... MPX exists but alas still has overheads in practice that can approach 50%... seems we can't match Lisp machines of decades ago that did it properly (in parallel) and for free [1].

1: https://stackoverflow.com/questions/40752436/do-any-cpus-hav...

convolvatron3• 3 years ago

hardware pointer type would be pretty cool too

wyldfire3• 3 years ago

Once the data escapes the CPU via a load or store, it's hard to enforce something like a "type" in hardware. ALU instructions operating on what appears to be integers could easily have been operating unknowingly on virtual addresses. Even if you used the "integer add" instruction, there's no way for it to know that it didn't just index into a buffer using a virtual address as a base.

However there are cooperative ISA features -- between compiler and CPU -- these can be used to constrain untrusted attackers. See ARM PAC, e.g.

fuklief• 3 years ago

See CHERI and Arm Morello https://www.arm.com/blogs/blueprint/morello

kazinator2• 3 years ago

I'm surprised we don't have better, performance-neutral hardware support for safety constructs like bounds checking.

It isn't necessary. Languages that have properly bounded arrays just emit the code and optimize it. E.g. if a loop steps a variable from i from 0 to N-1, accessing arr[i], the arr[i] bounds check can be moved out of the loop: if N-1 is within bounds, it's good to go.

I think the tooling being alluded to here is for checking bounds in programs that not only don't check it themselves, but don't pass around the information which makes it possible to know the size of an array.

The tooling has to build its own data structure to track objects and instrument the binary to intercept accesses; all of that is expensive.

cjbprime2• 3 years ago

Bounds checking isn't the only type of memory unsafety detected by sanitizers: they can also detect things like use-after-free, undefined behavior, and so on.

Someone• 3 years ago

Languages that have properly bounded arrays just emit the code and optimize it. E.g. if a loop steps a variable from i from 0 to N-1

Modern languages have for value in arr, arr.forEach or equivalent. Such code makes it easier for compiler writers to make this optimization.

Swift even chose to remove for loops that step a variable (https://github.com/apple/swift-evolution/blob/main/proposals...), and I don’t think Rust has them, either.

I think that’s the right decision. In modern languages, classical for loops are a code smell.

And of course, golang goes the other way. https://go.dev/tour/flowcontrol/1:

Go has only one looping construct, the for loop.

The basic for loop has three components separated by semicolons:

- the init statement: executed before the first iteration

- the condition expression: evaluated before every iteration

- the post statement: executed at the end of every iteration

wyldfire3• 3 years ago

ARM's MTE is often nicknamed "HWASAN" - it implements a lock-and-key metaphor. The memory allocations emitted by the compiler will get a "coloring" for the base pointed which can be matched with the specific region accessed by indexed loads and stores.

BTW this isn't just an experiment or research - some android developers have this enabled today and Android 14 beta has a user-configurable option to enable it.

convolvatron3• 3 years ago

so, like a segment?

pjmlp2• 3 years ago

Besides ARM in the sibling replies, Solaris on SPARC has been using ADI for a decade, iOS has PAC, CHERI is being worked on as Microsoft/ARM collaboration, and then there is ARM MTE on Azure Sphere as well.

https://docs.oracle.com/cd/E53394_01/html/E54815/gqajs.html

https://developer.apple.com/documentation/security/preparing...

https://msrc.microsoft.com/blog/2022/01/an_armful_of_cheris/

Because we have come to the realisation that only "C Machines" can fix this issue, as even if Safe C would come tomorrow, the existing software wouldn't be rewritten anyway.

cjbprime2• 3 years ago

This looks pretty great. If you prefer videos and examples you can walkthrough yourself, LiveOverflow's Youtube channel covers most of the sections here with more explanation:

https://youtube.com/@LiveOverflow

Archelaos• 3 years ago

PDF version at: https://llsoftsec.github.io/llsoftsecbook/book.pdf

Low-Level Software Security for Compiler Developers

Related Stories