Glibc堆利用若干方法.PDFVIP

第3 卷 第1 期 信 息 安 全 学 报 Vol. 3 No. 1 2018 年1 月 Journal of Cyber Security January, 2018 Glibc 堆利用的若干方法 裴中煜, 张 超, 段海新 清华大学 网络科学与网络空间研究院, 北京 中国 100084 摘要 内存中的攻击与防御一直是系统安全领域的重要研究课题之一, 而堆内存破坏漏洞利用以及防护以其特殊的性质在这场 宏大的攻防战中扮演着十分独特的角色。由于堆内存粒度细的缘故, 众多系统级的防御难以起到良好的效果。同时, 堆内存因 受运行时输入影响, 行为表现难以预测, 也给破坏的侦测增加了难度。本文收集了近年来堆内存攻防领域的优秀博文与论文, 回 顾了早期的glibc 堆利用方法以及之后glibc 与系统针对它们的修复方式。之后, 本文介绍了近年来流行的针对glibc 堆的现代利 用方法以及它们绕过系统保护的方式。最后, 本文根据所有的利用方法进行了堆利用特点的总结与梳理, 针对它们的特性提出 相应的减缓措施, 并预测了未来堆攻防博弈发展可能的趋势。 关键词 运行时库; 堆; 利用; 分配算法 中图法分类号 TP301 DOI 号 10.19363/10-1380/tn.2018.01.001 Several Methods of Exploiting Glibc Heap PEI Zhongyu, ZHANG Chao, DUAN Haixin Institute for Network Science and Cyberspace, Tsinghua University, Beijing 100084, China Abstract Attack and defense in memory has been an important research topic in the field of security systems for several decades. The heap memory corruption exploitation and protection play a very unique role in this grand arm race due to its special characteristic. Since the heap memory is of tiny granularity, many system-level defense methods are difficult to take good effect. Meanwhile, heap memory, affected by runtime user input, behaves unpredictably, which raises the diffi- culty of corruption detection. In this paper, we collect the outstanding blogs and thesis on heap memory arm race, and re- view the earlier exploit methods as well as the patch methods glibc has taken to defense them. Then, we introduce a few modern exploit methods against glibc and mitigations of system. At last, we conclude the key point of heap exploitation, put forward some mitigations against them, and predict the possible