S2malloc: Statistically Secure Allocator for Use-After-Free Protection and More

Attacks on heap memory are ever-increasing. Existing entropy-based secure memory allocators can provide statistical defenses against various heap-based exploits, including use-after-free (UAF). However, although UAF mitigation is in scope, such allocators are not tailored to detect failed UAF attempts. Consequently, an attacker can beat entropy-based protection by repeating the same attack, possibly in combination with heap spraying, to improve their chance of success further. We introduce \(\textsc {S2malloc}\) , aiming to enhance UAF-attempt detection without compromising other security guarantees or introducing significant overhead. \(\textsc {S2malloc}\) consists of three new constructs in the secure allocator design space: free block canaries (FBC) to detect UAF attempts, random in-block offset (RIO) to stop the attacker from accurately overwriting the victim object, and random bag layout (RBL) to impede attackers from estimating the block size based on its address. We show that \(\textsc {S2malloc}\) can detect UAF attempts with a reasonable probability and is practical, with only a 2.8% CPU overhead on PARSEC and an 11.5% CPU overhead on SPEC.