4 ms·

What would be the heap protection features you need? [1] lists a couple features that I find useful. Of course, in Firefox, we use valgrind and ASAN extensively

by padenot 13y ago

What would be the heap protection features you need? [1] lists a couple features that I find useful. Of course, in Firefox, we use valgrind and ASAN extensively in automation and during development, so it matters less for us. (edit: to reduce confusion, I just want to say that Firefox uses jemalloc, otherwise my comment makes no sense. It's however disabled if you compile Firefox for use with valgrind). [1]: https://github.com/jemalloc/jemalloc/wiki/Use-Case%3A-Find-a-memory-corruption-bug https://github.com/jemalloc/jemalloc/wiki/Use-Case%3A-Find-a...

xyzzy123 13y ago
Those are the debugging features. Those features (plus the tools you listed) help you during the test phase of your SDLC. In contrast, heap protection / exploit mitigation is intended to protect your software in the field from the bugs you did not know about until after the software shipped. Correct software would not need ASLR, stack canaries, NX or heap protection. But these things are widely accepted as required these days. Desirable features are mainly heap overflow protection and double free protection (see [1] for a list of what ptmalloc does). The situation is not entirely simple because the specific protections you want (say in terms of heap metadata protection) depend on the internal design of the allocator and there are a lot of devils in the details. There is some information around on jemalloc exploitation [2] [3], but I do not know if that information is current. I'm not aware of any jemalloc hardening which has happened since then. If you could provide any information in that area I'd be interested to know about it. [1] https://wiki.ubuntu.com/Security/Features#Heap_Protector https://wiki.ubuntu.com/Security/Features#Heap_Protector [2] http://phrack.org/issues/68/10.html#article http://phrack.org/issues/68/10.html#article [3] https://github.com/argp/unmask_jemalloc https://github.com/argp/unmask_jemalloc

by padenot 13y ago

xyzzy123 13y ago

Those are the debugging features. Those features (plus the tools you listed) help you during the test phase of your SDLC. In contrast, heap protection / exploit mitigation is intended to protect your software in the field from the bugs you did not know about until after the software shipped. Correct software would not need ASLR, stack canaries, NX or heap protection. But these things are widely accepted as required these days. Desirable features are mainly heap overflow protection and double free protection (see [1] for a list of what ptmalloc does). The situation is not entirely simple because the specific protections you want (say in terms of heap metadata protection) depend on the internal design of the allocator and there are a lot of devils in the details. There is some information around on jemalloc exploitation [2] [3], but I do not know if that information is current. I'm not aware of any jemalloc hardening which has happened since then. If you could provide any information in that area I'd be interested to know about it. [1] https://wiki.ubuntu.com/Security/Features#Heap_Protector https://wiki.ubuntu.com/Security/Features#Heap_Protector [2] http://phrack.org/issues/68/10.html#article http://phrack.org/issues/68/10.html#article [3] https://github.com/argp/unmask_jemalloc https://github.com/argp/unmask_jemalloc