Fast Pointer Nullification for Use-After-Free Prevention

Fast Pointer Nullification for Use-After-Free Prevention

Speakers: Yubo Du

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=fWP2zjVispw

Overview

This research presents FPN (Fast Pointer Nullification), a significantly more efficient approach to preventing use-after-free (UAF) vulnerabilities -- one of the most critical and increasingly common classes of memory safety bugs in low-level software. Previous pointer nullification systems incurred 22-56% runtime overhead and up to 200% memory overhead, making them impractical for production deployment. FPN reduces this to 17% runtime overhead and 8% memory overhead through two key innovations: aligned region-based metadata management (replacing expensive tree traversal or arithmetic operations with a single bit-shift and table lookup) and coarse-grained block-based registrations (exploiting the spatial locality of pointer stores to dramatically reduce registration count).

FPN provides equivalent or higher security protection compared to previous pointer nullification methods and has been validated against real-world CVEs affecting applications like Chrome, Nginx, and zlib. The work is open-sourced on GitHub.

Background

▶ Watch: Use-after-free vulnerability trend and root cause analysis (0:00)

Use-after-free vulnerabilities occur when a program frees a heap buffer but retains pointers ("dangling pointers") to the freed memory. If these pointers are later dereferenced, the program accesses invalid memory, which attackers can exploit for code execution or information disclosure. The number of UAF-related CVEs has been increasing year by year, making efficient prevention a pressing need.

Two major approaches exist for UAF prevention:

Garbage collection (GC) approaches extend the lifetime of freed buffers, delaying reuse until a full memory scan confirms no pointers reference the freed area. These introduce significant overhead through additional thread usage and higher memory consumption due to delayed buffer reuse.

Pointer nullification (PN) approaches take the opposite strategy: when a buffer is freed, all pointers to it are nullified (set to invalid addresses), so any subsequent dereference crashes the program safely. The challenge is that pointers can exist anywhere -- stack, heap, global memory -- and their locations are determined dynamically at runtime, not statically at compile time.

Previous PN systems like CRCount, DangNull, and CAMP work by maintaining metadata tables that track which memory locations store pointers to each heap buffer. When a buffer is freed, the system traverses all registered pointer locations, checks if they still point to the freed buffer, and nullifies them. However, two bottlenecks make this expensive: metadata addressing requires tree traversal or complex arithmetic operations, and every individual pointer store must be independently registered.

Key Findings

▶ Watch: How pointer nullification works: metadata, registration, deallocation (4:00)

Previous PN systems incur 22-56% runtime overhead and up to 200% memory overhead. Experiments on SPEC CPU 2017 and 2006 benchmarks confirmed that existing pointer nullification methods are too expensive for production use.

61% of overhead in CAMP comes from metadata addressing alone. The most recent prior work (CAMP) uses a cyclist allocator with constant-time addressing, but the arithmetic operations required still dominate performance costs.

Over 50% of pointer stores are within 16 bytes of each other. Analysis of the top 5 SPEC CPU 2017 benchmarks by pointer store count reveals strong spatial locality -- most pointer stores cluster in memory. At a 128-byte threshold, the nearby percentage is even higher. Previous PN methods ignore this locality by treating each pointer store independently.

FPN achieves 17% runtime overhead and 8% memory overhead. By exploiting spatial locality and simplifying metadata addressing, FPN reduces overhead by approximately 2-3x compared to the best previous methods.

FPN provides equivalent or higher security protection. Validation against real-world CVEs in Chrome, Nginx, zlib, and other applications confirms that the optimizations do not degrade security compared to previous PN methods.

Technical Deep Dive

▶ Watch: Spatial locality analysis: 50%+ of pointers within 16 bytes of each other (8:00)

FPN introduces two core design innovations:

Part 1: Aligned Region-Based Metadata Management. Instead of maintaining per-buffer metadata entries and using expensive operations to determine which buffer a pointer targets, FPN divides the heap into aligned regions of size 2^n bytes. Each region has a single metadata entry. To find the metadata for any pointer, FPN performs:

1. One bit-shift operation to compute the region ID from the pointer value
2. One table lookup to retrieve the metadata entry

This replaces the tree traversal (O(log n)) or complex arithmetic operations used by previous methods. Multiple heap buffers can share the same region metadata, reducing the total number of metadata entries. The tradeoff is that freeing a buffer within a region requires additional processing to identify which specific buffer is being freed, but this cost is negligible compared to the savings from per-store metadata addressing.

Part 2: Coarse-Grained Block-Based Registrations. FPN divides the address space into aligned blocks of size 2^m bytes. Instead of registering individual pointer storage locations, FPN registers the block containing the pointer. When a buffer is freed, FPN scans all registered blocks (rather than individual locations) to find and nullify dangling pointers.

To avoid excessive false-positive scanning, FPN maintains a lightweight shadow table where each bit indicates whether the corresponding 8-byte memory location stores a pointer. During deallocation, the scanner checks this bitmap to skip non-pointer locations, making the block-level scanning efficient despite its broader granularity.

In practice, this reduces registration count dramatically -- the paper shows an example where previous methods require 17 registrations but FPN requires only 3. The spatial locality analysis confirms this reduction is typical across real-world programs.

Parameter sensitivity: As region size increases, more buffers share metadata (reducing memory) but freeing becomes more expensive. As block size increases, fewer registrations are needed but more memory must be scanned during deallocation, converging toward garbage collection behavior. The shadow table mitigates this convergence by enabling selective scanning.

Demo / Proof of Concept

▶ Watch: FPN design: region-based metadata with bit-shift addressing (10:00)

FPN was evaluated in two dimensions:

Security validation: Real-world CVEs affecting Chrome, Nginx, zlib, and other widely-used applications were tested. FPN successfully detected and prevented all tested UAF exploits, providing equivalent or higher protection compared to previous PN methods including DangNull and CAMP.

Performance evaluation on SPEC CPU 2017: Previous PN systems incurred 31-56% runtime overhead and 29-173% memory overhead. FPN achieved 17% runtime overhead and 8% memory overhead -- a substantial improvement that makes pointer nullification more practical for production deployment.

The work is open-sourced on GitHub for reproduction and deployment.

Defensive Implications

▶ Watch: Results: 17% runtime, 8% memory overhead vs 31-56% and 29-173% in prior work (14:00)

Use-after-free vulnerabilities remain one of the most exploited vulnerability classes in modern software, particularly in browsers (Chrome), web servers, and system libraries. FPN's reduced overhead makes pointer nullification practical enough for broader deployment:

For software developers: FPN can be integrated into the build pipeline for C/C++ applications to provide runtime UAF protection with significantly lower overhead than previous approaches. The 17% runtime cost may be acceptable for security-critical applications where UAF exploitation could lead to remote code execution.

For browser vendors: DangNull was specifically designed for Chrome, but FPN provides a more general-purpose solution. The Chrome-specific evaluation in the paper suggests FPN is competitive with domain-specific approaches while being applicable to any C/C++ application.

For security teams: FPN does not eliminate UAF vulnerabilities (it prevents exploitation by crashing the program), so it should be viewed as a mitigation layer rather than a fix. Applications should still be patched for known UAF bugs, but FPN provides protection against unknown UAF vulnerabilities during the patching window.

Memory safety transition: While the industry gradually transitions to memory-safe languages (Rust, Go), FPN provides a practical mitigation for the vast existing C/C++ codebase that will remain in production for decades.

Key Takeaways

• Use-after-free CVEs are increasing year over year, making efficient prevention critical
• Previous pointer nullification methods incur 22-56% runtime and up to 200% memory overhead, making them impractical for production
• FPN reduces this to 17% runtime and 8% memory overhead through region-based metadata (bit-shift + table lookup) and block-based registrations
• Over 50% of pointer stores cluster within 16 bytes, enabling coarse-grained registration that dramatically reduces registration count
• FPN provides equivalent or higher security protection against real-world CVEs in Chrome, Nginx, zlib
• The work is open-sourced on GitHub for immediate adoption

About the Speaker(s)

Yubo Du is a PhD student at the University of Pittsburgh, working with Dr. Jun Yang. His research focuses on memory safety, specifically efficient runtime defenses against use-after-free vulnerabilities in C/C++ software. The work builds on and improves upon prior pointer nullification research including DangNull, CRCount, and CAMP.