论文标题
PACSAN：基于ARM PA执行记忆安全
PACSan: Enforcing Memory Safety Based on ARM PA
论文作者
论文摘要
内存安全性是阻止内存损坏漏洞的关键安全属性。现有的消毒剂在开发和测试过程中执行检查并捕获此类错误。但是，它们要么提供部分存储安全性，要么具有压倒性的高性能开销。我们的新型消毒剂pacsan在低性能的开销中执行空间和时间记忆安全，没有误报。 Pacsan通过将元数据密封在指针中通过ARM PA（指针身份验证）密封指针跟踪所涉及的大多数间接费用，并在重新引入指针时进行记忆安全检查。我们已经开发了Pacsan的原型，并系统地评估了其在Magma，Juliet，Nginx和Spec CPU2017测试套件上的安全性和性能。在我们的评估中，Pacsan没有显示误报以及可忽略不计的假否定性，同时引入了更强的安全保证和较低的性能开销，而不是最先进的消毒者，包括Hwasan，Asan，Asan，Softbound+CETS，Memcheck，Memcheck，Lowfat和Ptauth。具体而言，Pacsan平均具有0.84倍的运行时开销和1.92倍的内存开销。与广泛部署的Asan相比，Pacsan没有假阳性，错误的负面因素少得多，并且减少了7.172％的运行时开销和89.063％的内存开销。
Memory safety is a key security property that stops memory corruption vulnerabilities. Existing sanitizers enforce checks and catch such bugs during development and testing. However, they either provide partial memory safety or have overwhelmingly high performance overheads. Our novel sanitizer PACSan enforces spatial and temporal memory safety with no false positives at low performance overheads. PACSan removes the majority of the overheads involved in pointer tracking by sealing metadata in pointers through ARM PA (Pointer Authentication), and performing the memory safety checks when pointers are dereferenced. We have developed a prototype of PACSan and systematically evaluated its security and performance on the Magma, Juliet, Nginx, and SPEC CPU2017 test suites, respectively. In our evaluation, PACSan shows no false positives together with negligible false negatives, while introducing stronger security guarantees and lower performance overheads than state-of-the-art sanitizers, including HWASan, ASan, SoftBound+CETS, Memcheck, LowFat, and PTAuth. Specifically, PACSan has 0.84x runtime overhead and 1.92x memory overhead on average. Compared to the widely deployed ASan, PACSan has no false positives and much fewer false negatives and reduces 7.172% runtime overheads and 89.063%memory overheads.
