A walk down memory lane

Summary: Trail of Bits researcher Peter Goodman recounts building Granary, a binary translator that selectively instruments only Linux kernel modules while the rest of the kernel runs natively, and its Address Watchpoints technique, which embedded a taint-tracking ID in the high 15 bits of pointers returned by allocation functions like kmalloc to catch buffer overflows, use-before-initialization, and use-after-frees. He notes Address Watchpoints was not novel - SoftBound+CETS had applied a similar technique years earlier - and that the btkernel translator, released at the same 2013 HotDep/SOSP conference, applied many of the same techniques and beat his group to full paper publication.
Why it matters: The same idea for using Intel hardware transactional memory to enforce control-flow integrity appeared independently in his unpublished proof-of-concept and in a fuller implementation from Eurecom and UCSB researchers, and he set his aside because hardware transactions incur full memory barriers that kill ILP and concurrency, making the technique out of the question for real programs like Google Chrome, and because Intel's CET instruction set makes the approach dead on arrival.

Read the original at Trail of Bits Blog ↗