Guarder: A Tunable Secure Allocator

In one paragraph

Secure allocators are the first line of defense against heap attacks, but existing ones either randomize weakly, or their protection varies with object size, program phase, and input, or they cost 30 to 70% in performance. Guarder guarantees a chosen randomization entropy for every size class and every phase, combines the security features of prior secure allocators (randomization, guard pages, over-provisioning, delayed reuse, double- and invalid-free detection), and lets users dial security up or down against a performance budget without recompiling. Its overhead against the default Linux allocator is under 3%.

Key ideas

• Allocation and deallocation buffers: objects are picked at random from a buffer whose size sets the entropy independently of size class, so the guarantee is stable.
• Tunable security: entropy, guard-page ratio, and over-provisioning are runtime parameters, so the same binary can run at different security levels.
• All the features of prior secure allocators in one, without their scalability problems.

Results

• About 9.89 bits of entropy, which the paper translates to a 0.11% success rate per attack attempt, and over 200× more candidate objects to choose from than FreeGuard.
• Under 3% average performance overhead and about 27% memory overhead against the default Linux allocator. OpenBSD and DieHarder impose 31% and 74% runtime overhead in the same evaluation.
• Evaluated on 21 applications, including Apache httpd, Firefox, MySQL, Memcached, and SQLite.