MIRAGE: Randomizing large chunk allocation via dynamic binary instrumentation

Abstract

Heap security relies heavily on the randomness of chunk allocations in memory allocators to mitigate heap fengshui and heap spraying attacks, which are the most widely used techniques in modern exploits. However, randomness in large chunk allocation has been overlooked. Memory allocators directly call mmap (sometimes brk) syscall to allocate large chunks, while the Linux kernel does not provide a fine-grained randomization for mmap/brk syscall — only the base address is randomized, but the offset between every two syscalls is predictable. The less randomized large chunk will be vulnerable to heap fengshui and heap spraying attacks. In this paper, we assess the security of three most representative general-purpose memory allocators, Glibc ptmalloc, OpenBSD PHK malloc, and DieHarder, in scenario of large-chunk-based attacks, with successful heap fengshui and heap spraying attacks under Nginx. We then present MIRAGE, a transparent, portable, and memory allocator agnostic, runtime large chunk randomizer to fortify the existing memory allocators against large-chunk-based attacks. Large chunk fengshui and spraying attacks can be successfully mitigated by MIRAGE with a fine-grained randomization in mmap/brk syscall. And, MIRAGE imposes an acceptable overhead in performance.