FreeGuard: A Faster Secure Heap Allocator
Sam Silvestro, Hongyu Liu, Corey Crosser, Zhiqiang Lin, Tongping Liu
In one paragraph
Performance-oriented allocators have almost no defenses against heap attacks; secure allocators such as OpenBSD's or DieHarder defend but run up to 10× slower. FreeGuard sits in between: a new memory layout with segregated metadata and guard pages, randomized allocation, delayed reuse, and reliable detection of double and invalid frees, built with the free-list and shadow-memory techniques that make fast allocators fast. It runs within 2% of the default Linux allocator and considerably faster than existing secure allocators.
Key ideas
- A new heap layout: per-thread bags of size classes with metadata kept outside the heap, so heap corruption cannot reach allocator metadata.
- Borrow speed from fast allocators: free lists, shadow memory, and far fewer mmap calls than OpenBSD.
- Security features: randomized placement, guard pages placed under a user-set budget, delayed reuse against use-after-free, and detection of double and invalid frees.
Results
- Under 2% average overhead against the default Linux allocator.
- OpenBSD's allocator imposes about 22% on average, up to 3.9× slower than FreeGuard; DieHarder over 36%.
- Cuts mmap system calls to less than 10% of OpenBSD's.
- Open source at github.com/UTSASRG/FreeGuard.
Why it matters for Teyon
The same team later built Guarder and NUMAlloc on these foundations. Low-overhead memory management is the floor under everything Teyon runs inside a training process.
Read the original
This page is our summary. The paper itself, peer-reviewed at CCS '17, is the source of every number above.