BUDAlloc: Defeating Use-After-Free Bugs by Decoupling Virtual Address Management from Kernel

BUDAlloc: Defeating Use-After-Free Bugs by Decoupling Virtual Address Management from Kernel

Speakers: Junho Ahn

Conference: USENIX Security '24

YouTube: https://www.youtube.com/watch?v=Y21_QmmIcI0

Overview

In the realm of memory safety vulnerabilities, Use-After-Free (UAF) bugs stand as a persistent and critical threat, particularly in systems developed with unsafe memory languages like C and C++. These vulnerabilities arise when a program attempts to access memory that has been freed and potentially reallocated for another purpose, leading to unpredictable behavior, data corruption, and often, severe security implications such as arbitrary code execution or control flow hijacking. Junho Ahn's talk at USENIX Security '24 introduces BUDAlloc, an innovative memory allocator designed to decisively defeat UAF bugs by fundamentally rethinking the relationship between user-space virtual address management and the kernel.

BUDAlloc tackles the long-standing challenge of UAF detection and prevention by decoupling virtual address management from the kernel. This novel approach eliminates the performance bottlenecks and compatibility issues that have plagued prior attempts to build practical UAF-resistant allocators. By leveraging Extended Berkeley Packet Filter (eBPF) to enable safe, direct metadata sharing between user and kernel space, BUDAlloc sidesteps the "semantic gap" problem, a key hurdle for previous designs. The talk highlights BUDAlloc's superior performance, low memory overhead, and high precision in detecting UAF vulnerabilities, positioning it as a significant advancement in memory safety.

The significance of BUDAlloc cannot be overstated, given the pervasive nature of UAF vulnerabilities. As highlighted by Google's 2022 report, over half of the high-severity bugs discovered in Google Chrome were attributed to UAF issues. Traditional mitigations often come with substantial performance penalties or compatibility limitations, making their widespread adoption impractical. BUDAlloc aims to resolve these trade-offs, offering a robust and efficient solution that could profoundly enhance the security posture of systems relying on C/C++ memory management, from operating systems to critical applications.

Background

▶ Watch: Introduction to Use-After-Free vulnerabilities and impact (0:00)

Use-After-Free (UAF) vulnerabilities represent a critical class of memory safety bugs that arise when a program continues to use a pointer to memory after that memory has been deallocated. Once freed, the memory region might be reallocated for a new, unrelated object. If the original pointer is subsequently dereferenced, it can lead to accessing invalid data, corrupting the new object, or even executing arbitrary code by manipulating program control flow. This makes UAF a highly sought-after primitive for attackers, enabling a wide range of malicious actions in C and C++ programs. The severity of UAF is underscored by its prevalence; in 2022, Google reported that over 50% of high-severity bugs found in Chrome were UAF vulnerabilities, emphasizing the urgent need for effective prevention mechanisms.

Early approaches to detecting and preventing UAF often involved one-time allocators. The core idea behind a one-time allocator is that when an object is allocated, it resides on a dedicated memory page (typically 4 kilobytes). Upon freeing the object, the allocator immediately removes the page mapping from the page table. Any subsequent attempt to access the freed object would then trigger a page fault, effectively detecting the UAF. While robust in its detection mechanism, this naive approach suffers from extremely high memory overhead, as every new allocation would require a fresh, dedicated virtual address and page.

To mitigate this memory overhead, the concept of alias mapping was introduced. In this refined design, the virtual address space is logically divided into two parts: a canonical virtual address space managed by the allocator, and an alias virtual address space used by applications. When an application requests memory, the one-time allocator assigns a non-overlapping page-aligned memory region from the alias space and maps this alias virtual address to a canonical virtual address. Multiple alias virtual addresses can map to the same canonical address, allowing for more efficient use of physical memory. Despite this optimization, the one-time allocator with alias mapping could still detect UAF by removing the alias mapping from the page table upon deallocation.

However, practical deployment of one-time allocators, even with alias mapping, faced significant hurdles due to a fundamental architectural challenge known as the semantic gap problem. This problem arises because user-space allocators manage alias-to-canonical mappings using their own metadata, while the kernel independently manages virtual-to-physical address mappings in the page table. User and kernel spaces are isolated, meaning they lack direct knowledge of each other's memory management state. To synchronize these states, a one-time allocator must issue frequent system calls (e.g., mprotect, munmap) for each memory allocation and deallocation. Crucially, these system calls often involve acquiring a global kernel lock, which becomes a major performance bottleneck, especially in multi-threaded or multi-core environments.

Prior work attempted to address the semantic gap with varying degrees of success:

• Oscar batched system calls to reduce overhead but suffered from low performance and lacked support for copy-on-write functionality.
• FF removed alias-to-canonical mappings but incurred high memory overhead and offered lower precision in UAF detection.
• Danger, a more recent effort, tried to eliminate the semantic gap by utilizing a library operating system. While innovative, this approach introduced unavoidable virtualization overhead and suffered from low-level compatibility issues, as it required integration with virtual machines.

In essence, no previous work managed to achieve a balanced solution that simultaneously offered high performance, low memory overhead, precise UAF detection, good scalability, and broad compatibility. The semantic gap remained the primary constraint, preventing the widespread adoption of practical UAF-resistant memory allocators.

Key Findings

▶ Watch: Mitigating memory overhead with alias mapping technique (2:10)

BUDAlloc introduces a paradigm shift in memory management by decoupling virtual address management from the kernel, effectively bridging the semantic gap that has hindered previous UAF mitigation techniques. The core innovation lies in enabling direct, safe sharing of metadata between user and kernel spaces, eliminating the need for frequent, performance-intensive system calls and global kernel locks.

The key findings and contributions of BUDAlloc include:

1. Elimination of the Semantic Gap: By using Extended Berkeley Packet Filter (eBPF), BUDAlloc allows the user-space allocator to safely share its alias-to-canonical mapping metadata directly with the kernel. This enables the kernel to handle page faults using this shared "shadow metadata" within a custom page fault handler, thereby bypassing the traditional system call overhead and duplicated metadata management costs.
2. Superior Performance and Scalability: BUDAlloc achieves performance comparable to or better than standard general-purpose allocators like Glibc's malloc (GFC), even under high concurrency. It effectively eliminates the global kernel lock bottleneck, which plagues previous one-time allocators, by supporting fine-grained locking using user-space semantics. This makes it highly scalable for multi-threaded applications.
3. Low Memory Overhead: Unlike prior works like FF, which showed significantly higher memory overhead (e.g., 70% higher than GFC), BUDAlloc maintains a memory footprint comparable to standard allocators. This is crucial for practical deployment in memory-sensitive applications.
4. High Precision UAF Detection: In its "detection mode," BUDAlloc successfully detects 100% of UAF attacks in the evaluated CB Benchmark set. It also offers a "prevention mode" (referred to as "Border prevent" in the talk) which, while deferring immediate UAF detection for performance optimization, still detects approximately 97% of UAFs by the next page fault. This demonstrates a significant improvement over previous work like FF, which only detected about 23% of UAFs in similar benchmarks.
5. Broad Compatibility: BUDAlloc transparently leverages existing kernel physical memory management features. This design ensures broad compatibility with existing kernel functionalities and allows it to integrate seamlessly without requiring extensive modifications to the operating system or applications, avoiding the virtualization overhead and compatibility issues of solutions like Danger.
6. Optimizations for Performance: BUDAlloc includes an option to defer alias freeing until the next page fault in its "prevention mode." This optimization further improves performance, balancing immediate detection with execution speed, making it suitable for environments where maximum throughput is critical.

In essence, BUDAlloc successfully resolves the long-standing trade-offs between performance, memory overhead, detection precision, and compatibility, positioning it as a practical and highly effective solution for mitigating Use-After-Free vulnerabilities.

Technical Deep Dive

▶ Watch: Analysis of prior work and their limitations (4:40)

BUDAlloc's fundamental innovation lies in its architectural decision to decouple virtual address management from the kernel. This approach directly addresses the semantic gap problem by enabling a cooperative, synchronized view of memory state between user space and kernel space without relying on the costly system call interface.

The traditional design of one-time allocators involves two isolated components:

1. User-space allocator: Manages alias-to-canonical virtual address mappings using its own metadata.
2. Kernel: Manages virtual-to-physical translations and handles page faults, unaware of the user-space allocator's specific virtual address semantics.

This separation necessitates frequent system calls to synchronize user-space metadata with the kernel's page table, leading to performance degradation due to context switches and global kernel lock contention.

BUDAlloc re-architects this by introducing a shared metadata mechanism and a custom page fault handler within the kernel. The key components and mechanisms are:

1. Shared Metadata via eBPF:

• BUDAlloc utilizes Extended Berkeley Packet Filter (eBPF) to safely share metadata between the user-space allocator and the kernel. eBPF is a powerful, flexible, and secure in-kernel virtual machine that allows user-defined programs to run within the kernel, triggered by various events (e.g., system calls, network events, page faults).
• In BUDAlloc, eBPF is employed to allow the user-space allocator to expose its alias-to-canonical mappings directly to the kernel. This shared metadata acts as a "shadow metadata" that the kernel can consult.
• The use of eBPF is critical for safety and security. eBPF programs are verified by the kernel's verifier to ensure they are safe to execute, do not crash the kernel, and terminate within a reasonable timeframe, thus preventing malicious or buggy user-space logic from compromising kernel integrity.

1. Decoupled Virtual Address Management:

• With the shared metadata in place, the user-space allocator (BUDAlloc itself) takes primary responsibility for managing the virtual address space, specifically the alias virtual addresses and their mappings to canonical virtual addresses.
• The kernel's role is streamlined to essential physical memory management tasks. It no longer needs to independently track the semantics of alias mappings.

1. Custom Page Fault Handler:

• When a program attempts to access a virtual address that is not currently mapped in the page table (a page fault occurs), the kernel's custom page fault handler is invoked.
• Instead of relying on generic kernel logic or requiring a system call back to user space, this custom handler directly reads the shared metadata (provided via eBPF) to understand the alias-to-canonical mapping for the faulting address.
• Based on this information, the handler can then perform the necessary actions:
• If the alias address is valid and mapped to a canonical address, the handler can update the page table to establish the virtual-to-physical mapping.
• If the alias address corresponds to a freed object (detected as a UAF), the page fault can be used to trigger an alert or terminate the program.

1. Overall Design Flow:

• Allocation:

1. BUDAlloc first allocates a canonical address.
2. Then, it allocates a non-overlapping page alias address.
3. The shared metadata is updated with the alias-to-canonical mapping.

• Deallocation (Detection Mode):

1. When an object is freed, BUDAlloc updates the shared metadata to invalidate the alias-to-canonical mapping.
2. The kernel's custom page fault handler will then detect any subsequent access to this freed alias address as a UAF.

• Deallocation (Prevention Mode / "Border prevent"):

1. In this performance-optimized mode, BUDAlloc may defer the immediate invalidation of the alias mapping in the shared metadata.
2. UAF detection is deferred until the next page fault related to that memory region. This means that while UAF might not be detected immediately upon access, it will be caught when the page fault handler eventually consults the shared metadata, which will then reflect the freed state. This mode trades immediate detection for improved performance, as the overhead of metadata updates is reduced.

This decoupled design, facilitated by eBPF, allows BUDAlloc to eliminate the global kernel lock contention and duplicated metadata management costs inherent in prior approaches. It enables fine-grained locking using user-space semantics, contributing to its superior scalability and performance. The system's transparency is maintained as BUDAlloc seamlessly integrates with existing kernel physical memory management features, ensuring broad compatibility without introducing virtualization overhead.

Demo / Proof of Concept

▶ Watch: BUDAlloc's solution: Decoupling VA management from kernel (6:00)

While the talk did not feature a live, interactive demonstration of BUDAlloc in action, the speaker presented compelling evaluation results that served as a proof of concept for its effectiveness and performance. The primary method for validating BUDAlloc's capabilities involved its application to a Use-After-Free (UAF) CB Benchmark set. This benchmark suite is specifically designed to test the detection capabilities of memory allocators against known UAF patterns.

The evaluation highlighted two distinct modes of BUDAlloc:

1. Detection Mode: In this mode, BUDAlloc is configured for maximum UAF detection precision. The results showed that BUDAlloc successfully detected 100% of all attacks present in the CB Benchmark set. This indicates a highly reliable and accurate mechanism for identifying UAF vulnerabilities as they occur.
2. Prevention Mode (referred to as "Border prevent"): This mode is optimized for performance by deferring the immediate invalidation of alias mappings until the next page fault. Despite this optimization, BUDAlloc's prevention mode still detected approximately 97% of the Use-After-Free instances in the benchmark set. This demonstrates a robust level of protection even when prioritizing runtime efficiency.

To contextualize these findings, the speaker compared BUDAlloc's performance and detection rates against existing solutions:

• FF (a previous work): In the same UAF CB Benchmark set, FF only managed to detect about 23% of the UAFs. This stark contrast underscores BUDAlloc's significant advancement in detection precision, attributing the difference to BUDAlloc's extended "detection window" afforded by its decoupled design and custom page fault handler, which can catch UAFs even if detection is deferred to the next page fault.

Beyond UAF detection, the evaluation also assessed BUDAlloc's practical viability by measuring its performance, memory overhead, and scalability:

• Performance: When tested with a real-world web server like Apache under increasing numbers of concurrent connections, BUDAlloc (both detection and prevention modes) showed performance similar to or better than Glibc's malloc (GFC). This is a critical finding, as it demonstrates that BUDAlloc can provide robust UAF protection without introducing significant runtime overhead, a common drawback of prior secure allocators. In contrast, garbage collection-based allocators showed the worst performance due to the overhead of additional threads for garbage collection.
• Memory Overhead: BUDAlloc exhibited memory overhead comparable to GFC. This contrasts sharply with previous work like FF, which showed approximately 70% higher memory overhead compared to GFC, primarily because FF batches frees, leading to temporary memory retention. BUDAlloc's efficient management prevents such substantial increases.
• Scalability: The evaluation confirmed that BUDAlloc effectively eliminates the global kernel lock bottleneck, allowing it to scale well with increasing concurrency. This is a direct benefit of its decoupled design and fine-grained locking, making it suitable for modern multi-core systems.

In summary, the evaluation results served as a comprehensive proof of concept, demonstrating that BUDAlloc achieves a superior balance of high performance, low memory overhead, excellent scalability, and highly precise UAF detection, outperforming previous efforts to address this critical class of vulnerabilities.

Defensive Implications

▶ Watch: BUDAlloc evaluation results: detection and performance (7:55)

BUDAlloc presents a significant advancement in the arsenal available to security defenders, particularly those operating in environments where C and C++ applications form the backbone of critical infrastructure and services. The implications for defense are profound, offering a robust and practical solution to a pervasive and high-impact class of vulnerabilities.

Here's how BUDAlloc impacts defensive strategies:

1. Proactive UAF Mitigation at the Core: Instead of relying solely on reactive measures like vulnerability scanning or patch management, BUDAlloc offers a proactive defense directly at the memory allocation layer. By integrating BUDAlloc into the core runtime of applications or operating systems, developers can significantly reduce the attack surface related to UAF vulnerabilities. This shifts the defensive posture from finding and fixing individual bugs to preventing an entire class of exploitation techniques.

1. Reduced Exploitation Window: BUDAlloc's high precision in detecting UAFs, whether immediately in detection mode (100% detection) or by the next page fault in prevention mode (97% detection), drastically shrinks the window of opportunity for attackers. Even in the performance-optimized prevention mode, an attacker attempting to leverage a UAF would likely trigger a page fault, leading to detection and potential program termination, long before a successful exploit chain could be completed.

1. Enhanced System Stability and Reliability: Beyond security, UAF bugs are a major source of system crashes and unpredictable behavior. By effectively preventing these bugs from manifesting, BUDAlloc contributes to overall system stability and reliability, reducing downtime and improving user experience.

1. Practicality for Wide Adoption: The key strength of BUDAlloc from a defensive perspective is its practicality. Previous UAF mitigations often came with unacceptable performance overheads or compatibility issues, limiting their adoption to highly specialized or performance-insensitive contexts. BUDAlloc's demonstrated performance comparable to Glibc's malloc, low memory overhead, and broad kernel compatibility remove these barriers. This makes it a viable candidate for integration into a wide range of systems, from operating system kernels to high-performance server applications like Apache.

1. Leveraging Modern Kernel Capabilities (eBPF): BUDAlloc's reliance on eBPF highlights a growing trend in security: leveraging advanced kernel capabilities for robust, in-kernel defenses. For defenders, understanding and advocating for the use of such technologies is crucial. It demonstrates how secure design can be achieved without sacrificing performance by intelligently co-opting kernel mechanisms.

1. Guidance for Developers and Architects: For developers, the message is clear: consider adopting BUDAlloc or similar decoupled memory management approaches for new projects or when refactoring existing C/C++ codebases. For security architects, BUDAlloc provides a blueprint for designing memory safety into the foundational layers of systems, rather than treating it as an afterthought. It suggests a move towards allocators that are "UAF-aware" by design, rather than relying on generic, unhardened memory managers.

In essence, BUDAlloc empowers defenders with a robust, performant, and compatible tool to tackle one of the most persistent and dangerous classes of memory safety vulnerabilities. Its widespread adoption could significantly raise the bar for exploit development, making systems inherently more resilient against a broad spectrum of attacks.

Key Takeaways

• UAF is a Critical and Pervasive Threat: Use-After-Free (UAF) vulnerabilities remain a top concern in C/C++ programs, accounting for over 50% of high-severity bugs in Google Chrome in 2022, leading to severe consequences like arbitrary code execution.
• Semantic Gap Hindered Prior Solutions: Existing one-time allocators, even with alias mapping, struggled with a "semantic gap" between user-space and kernel memory management, leading to performance bottlenecks from frequent system calls and global kernel lock contention.
• BUDAlloc Decouples VA Management: BUDAlloc solves the semantic gap by decoupling virtual address management from the kernel, allowing user-space to manage alias-to-canonical mappings directly, while the kernel handles physical memory and page faults using shared metadata.
• eBPF Enables Safe Metadata Sharing: The use of Extended Berkeley Packet Filter (eBPF) is central to BUDAlloc, enabling safe and direct sharing of metadata between user and kernel space, eliminating the need for costly system calls and significantly improving performance and scalability.
• Superior Performance and Detection: BUDAlloc achieves performance comparable to standard allocators like Glibc's malloc (GFC) and significantly lower memory overhead (e.g., 70% less than FF), while offering 100% UAF detection in its "detection mode" and 97% in its performance-optimized "prevention mode."
• Practical and Compatible UAF Defense: By balancing high performance, low memory overhead, and broad compatibility with existing kernel functionalities, BUDAlloc offers a practical and robust solution for mitigating UAF vulnerabilities, making it a strong candidate for widespread adoption in C/C++ systems.

About the Speaker(s)

Junho Ahn is the speaker who presented the work on BUDAlloc at USENIX Security '24. From the presentation, it is clear that Junho Ahn is a researcher deeply involved in memory safety, operating system security, and the development of advanced memory allocation techniques. The detailed technical depth and comprehensive evaluation presented in the talk reflect a strong background in systems-level programming and security research. While specific affiliations or titles beyond "Junho Ahn" were not explicitly stated in the provided transcript or metadata, the quality and innovation of BUDAlloc position him as a significant contributor to the field of computer security.