内存地址泄漏分析与防御  

Survey of Memory Address Leakage and Its Defense

作　　者：傅建明[1,2,3] 刘秀文[1,2] 汤毅[1,2] 李鹏伟[1,2] 

机构地区：[1]空间信息安全与可信计算教育部重点实验室(武汉大学),武汉430072 [2]武汉大学计算机学院,武汉430072 [3]软件工程国家重点实验室(武汉大学),武汉430072

出　　处：《计算机研究与发展》2016年第8期1829-1849,共21页Journal of Computer Research and Development

基　　金：国家自然科学基金项目(61373168;61202387;61332019);高等学校博士学科点专项科研基金项目(20120141110002)~~

摘　　要：高级持续性威胁(advanced persistent threat,APT)攻击通常会利用内存地址泄漏绕过地址空间布局随机化(address space layout randomization,ASLR)、利用面向返回编程技术(return-oriented programming,ROP)绕过数据执行保护(data execution prevention,DEP).针对内存地址泄漏漏洞,以漏洞实例为样本,剖析了各种造成越界内存访问的指针或对象的非法操作,以及侧信道信息泄漏漏洞,并基于造成内存泄漏的过程,给出了相应的漏洞分类.同时,从漏洞利用和攻击的过程出发,总结和归纳了内存布局随机化、内存越界读写保护、内存对象内容保护、内存对象地址随机化等对抗内存地址泄漏的防御方法,从而达到内存布局看不清、内存对象读不到、内存对象内容读不懂、关键内存地址猜不准的保护目的.最后,提出从程序设计角度提供对内存布局随机化、代码地址随机化、内存对象保护等的支持,同时与操作系统建立协作防御机制,从而构建纵深和立体的安全防御体系.With memory address leakage,an attacker can bypass ALSR（address space layout randomization）mechanism,deploy ROP（return-oriented programming）chains to close the DEP（data execution prevention）,and divert the program to execute Shellcode.With regard to memory address leakage,this paper gathers the related information of vulnerability instances, presents the classification of vulnerabilities resulting in memory address leakage based on the procedure of memory leakage.The paper analyzes all kinds of illegal operations of pointer or object which cause the operation of cross-border memory access,as well as side-channel information leakage.In the meantime,this paper divids the defense methods of memory address leakage into four categories according to the procedure of memory corruption attacks,including memory layout randomization,object border protection,object content protection,and the critical address information randomization.And these protections make memory layout vague,memory object unavailable,memory object unreadable and critical memory address untraceable.Finally,this paper points out that we need to provide support of memory layout randomization,fine-grained memory address randomization and object content protection in perspective of programming design,adapting the operating system to establish collaborative defense mechanism in order to build robust defense system in depth.

关 键 词：APT攻击 内存损坏 内存地址泄漏 地址空间布局随机化 边界保护 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]