[go: up one dir, main page]
More Web Proxy on the site http://driver.im/ skip to main content
10.1145/3485832.3485903acmotherconferencesArticle/Chapter ViewAbstractPublication PagesacsacConference Proceedingsconference-collections
research-article
Open access

Keeping Safe Rust Safe with Galeed

Published: 06 December 2021 Publication History

Abstract

Rust is a programming language that simultaneously offers high performance and strong security guarantees. Safe Rust (i.e., Rust code that does not use the unsafe keyword) is memory and type safe. However, these guarantees are violated when safe Rust interacts with unsafe code, most notably code written in other programming languages, including in legacy C/C++ applications that are incrementally deploying Rust. This is a significant problem as major applications such as Firefox, Chrome, AWS, Windows, and Linux have either deployed Rust or are exploring doing so. It is important to emphasize that unsafe code is not only unsafe itself, but also it breaks the safety guarantees of ‘safe’ Rust; e.g., a dangling pointer in a linked C/C++ library can access and overwrite memory allocated to Rust even when the Rust code is fully safe.
This paper presents Galeed, a technique to keep safe Rust safe from interference from unsafe code. Galeed has two components: a runtime defense to prevent unintended interactions between safe Rust and unsafe code and a sanitizer to secure intended interactions. The runtime component works by isolating Rust’s heap from any external access and is enforced using Intel Memory Protection Key (MPK) technology. The sanitizer uses a smart data structure that we call pseudo-pointer along with automated code transformation to avoid passing raw pointers across safe/unsafe boundaries during intended interactions (e.g., when Rust and C++ code exchange data). We implement and evaluate the effectiveness and performance of Galeed via micro- and macro-benchmarking, and use it to secure a widely used component of Firefox.

References

[1]
Martín Abadi, Mihai Budiu, Ulfar Erlingsson, and Jay Ligatti. 2009. 4Control-Flow Integrity Principles, Implementations, and Applications. ACM Transactions on Information and System Security (TISSEC) (2009).
[2]
David Bigelow, Thomas Hobson, Robert Rudd, William Streilein, and Hamed Okhravi. 2015. Timely Rerandomization for Mitigating Memory Disclosures. In Proceedings of the 22nd ACM Computer and Communications Security (CCS’15).
[3]
Barry Bond, Chris Hawblitzel, Manos Kapritsos, K Rustan M Leino, Jacob R Lorch, Bryan Parno, Ashay Rane, Srinath Setty, and Laure Thompson. 2017. Vale: Verifying High-Performance Cryptographic Assembly Code. In 26th USENIX Security Symposium (USENIX Security 17).
[4]
Adam Burch. 2019. Using Rust in Windows. https://msrc-blog.microsoft.com/2019/11/07/using-rust-in-windows.
[5]
Nathan Burow, Scott A. Carr, Joseph Nash, Per Larsen, Michael Franz, Stefan Brunthaler, and Mathias Payer. 2017. Control-Flow Integrity: Precision, Security, and Performance. ACM Comput. Surv. 50, 1 (April 2017).
[6]
Center for Internet Security. 2019. Multiple Vulnerabilities in Google Android OS Could Allow for Arbitrary Code Execution. https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-android-os-could-allow-for-arbitrary-code-execution_2019-088.
[7]
Catalin Cimpanu. 2019. A Rust-based TLS library outperformed OpenSSL in almost every category. https://www.zdnet.com/article/a-rust-based-tls-library-outperformed-openssl-in-almost-every-category.
[8]
R Joseph Connor, Tyler McDaniel, Jared M Smith, and Max Schuchard. 2020. PKU Pitfalls: Attacks on PKU-based Memory Isolation Systems. In 29th USENIX Security Symposium (USENIX Security 20).
[9]
Crispin Cowan, Steve Beattie, Ryan Finnin Day, Calton Pu, Perry Wagle, and Erik Walthinsen. 1999. Protecting systems from stack smashing attacks with StackGuard. In Linux Expo.
[10]
Hoang-Hai Dang, Jacques-Henri Jourdan, Jan-Oliver Kaiser, and Derek Dreyer. 2019. RustBelt Meets Relaxed Memory. Proceedings of the ACM on Programming Languages (POPL) (2019).
[11]
Arthur Azevedo De Amorim, Maxime Dénès, Nick Giannarakis, Catalin Hritcu, Benjamin C Pierce, Antal Spector-Zabusky, and Andrew Tolmach. 2015. Micro-Policies: Formally Verified, Tag-Based Security Monitors. In 2015 IEEE Symposium on Security and Privacy.
[12]
David Detlefs, Al Dosser, and Benjamin Zorn. 1994. Memory Allocation Costs in Large C and C++ Programs. Software: Practice and Experience(1994).
[13]
Joe Devietti, Colin Blundell, Milo MK Martin, and Steve Zdancewic. 2008. HardBound: Architectural Support for Spatial Safety of the C Programming Language. ACM SIGOPS Operating Systems Review(2008).
[14]
Udit Dhawan, Nikos Vasilakis, Raphael Rubin, Silviu Chiricescu, Jonathan M Smith, Thomas F Knight Jr, Benjamin C Pierce, and André DeHon. 2014. PUMP: A Programmable Unit for Metadata Processing. In Proceedings of the Third Workshop on Hardware and Architectural Support for Security and Privacy (HASP).
[15]
Alan AA Donovan and Brian W Kernighan. 2015. The Go programming language. Addison-Wesley Professional.
[16]
Gregory J Duck and Roland HC Yap. 2016. Heap bounds protection with low fat pointers. In Proceedings of the 25th International Conference on Compiler Construction. 132–142.
[17]
Gregory J Duck, Roland HC Yap, and Lorenzo Cavallaro. 2017. Stack Bounds Protection with Low Fat Pointers. In NDSS, Vol. 17. 1–15.
[18]
Dominik Durner, Viktor Leis, and Thomas Neumann. 2019. On the Impact of Memory Allocation on High-Performance Query Processing. In Proceedings of the 15th International Workshop on Data Management on New Hardware (DaMoN).
[19]
Isaac Evans, Sam Fingeret, Julian Gonzalez, Ulziibayar Otgonbaatar, Tiffany Tang, Howard Shrobe, Stelios Sidiroglou-Douskos, Martin Rinard, and Hamed Okhravi. 2015. Missing the Point(er): On the Effectiveness of Code Pointer Integrity. In Proceedings of the IEEE Symposium on Security and Privacy (Oakland’15) (San Jose, CA).
[20]
Isaac Evans, Fan Long, Ulziibayar Otgonbaatar, Howard Shrobe, Martin Rinard, Hamed Okhravi, and Stelios Sidiroglou-Douskos. 2015. Control Jujutsu: On the Weaknesses of Fine-Grained Control Flow Integrity. In Proceedings of the 22nd ACM Computer and Communications Security (CCS’15).
[21]
Reza Mirzazade Farkhani, Saman Jafari, Sajjad Arshad, William Robertson, Engin Kirda, and Hamed Okhravi. 2018. On the Effectiveness of Type-based Control Flow Integrity. In Proceedings of IEEE Annual Computer Security Applications Conference (ACSAC’18).
[22]
Wedson Almeida Filho. 2021. Rust in the Linux kernel - Google Security Blog. https://security.googleblog.com/2021/04/rust-in-linux-kernel.html.
[23]
Bryan Ford and Russ Cox. 2008. Vx32: Lightweight, User-level Sandboxing on the x86. In USENIX Annual Technical Conference.
[24]
Aymeric Fromherz, Nick Giannarakis, Chris Hawblitzel, Bryan Parno, Aseem Rastogi, and Nikhil Swamy. 2019. A Verified, Efficient Embedding of a Verifiable Assembly Language. Proceedings of the ACM on Programming Languages (POPL) (2019).
[25]
Ronald Gil, Hamed Okhravi, and Howard Shrobe. 2018. There’s a Hole in the Bottom of the C: On the Effectiveness of Allocation Protection. In Proceedings of the IEEE Secure Development Conference (SecDev18).
[26]
Google. [n.d.]. Chromium. https://www.chromium.org/Home.
[27]
Google. [n.d.]. Google Chrome. https://www.google.com/chrome.
[28]
Google. [n.d.]. Memory safety - The Chromium Projects. https://www.chromium.org/Home/chromium-security/memory-safety. Accessed on 2021-05-14.
[29]
Mohammad Hedayati, Spyridoula Gravani, Ethan Johnson, John Criswell, Michael L Scott, Kai Shen, and Mike Marty. 2019. Hodor: Intra-Process Isolation for High-Throughput Data Plane Libraries. In 2019 USENIX Annual Technical Conference (USENIX ATC 19).
[30]
Intel. 2021. Intel®64 and IA-32 Architectures Software Developer’s Manual.
[31]
Ralf Jung, Jacques-Henri Jourdan, Robbert Krebbers, and Derek Dreyer. 2017. RustBelt: Securing the Foundations of the Rust Programming Language. Proceedings of the ACM on Programming Languages (POPL) (2017).
[32]
Ralf Jung, Jacques-Henri Jourdan, Robbert Krebbers, and Derek Dreyer. 2020. Safe Systems Programming in Rust: The Promise and the Challenge. Commun. ACM (2020).
[33]
Ralf Jung, David Swasey, Filip Sieczkowski, Kasper Svendsen, Aaron Turon, Lars Birkedal, and Derek Dreyer. 2015. Iris: Monoids and Invariants as an Orthogonal Basis for Concurrent Reasoning. ACM SIGPLAN Notices (2015).
[34]
Benjamin Lamowski, Carsten Weinhold, Adam Lackorzynski, and Hermann Härtig. 2017. Sandcrust: Automatic Sandboxing of Unsafe Components in Rust. In Proceedings of the 9th Workshop on Programming Languages and Operating Systems (PLOS).
[35]
Per Larsen, Andrei Homescu, Stefan Brunthaler, and Michael Franz. 2014. SoK: Automated software diversity. In 2014 IEEE Symposium on Security and Privacy. IEEE, 276–291.
[36]
Ryan Levick. 2019. Why Rust for safe systems programming. https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe-systems-programming.
[37]
Tim Lindholm, Frank Yellin, Gilad Bracha, and Alex Buckley. 2014. The Java virtual machine specification. Pearson Education.
[38]
Linux Kernel Organization. [n.d.]. The Linux Kernel Archives. https://www.kernel.org.
[39]
Rahul Manghwani and Tao He. 2011. Scalable memory allocation. https://locklessinc.com/downloads/Preso05-MemAlloc.pdf.
[40]
Nicholas D Matsakis and Felix S Klock. 2014. The rust language. ACM SIGAda Ada Letters 34, 3 (2014), 103–104.
[41]
Microsoft. 2006. A detailed description of the Data Execution Prevention (DEP) feature in Windows XP Service Pack 2, Windows XP Tablet PC Edition 2005, and Windows Server 2003. Online. http://support.microsoft.com/kb/875352/en-us
[42]
Microsoft. 2014. Lesson 2 - Windows NT System Overview. https://docs.microsoft.com/en-us/previous-versions//cc767881(v=technet.10).
[43]
Matthew Miller. 2019. Trends, challenges, and strategic shifts in the software vulnerability mitigation landscape. https://github.com/microsoft/MSRC-Security-Research/blob/master/presentations/2019_02_BlueHatIL/2019_01 - BlueHatIL - Trends, challenge, and shifts in software vulnerability mitigation.pdf.
[44]
Robin Milner. 1978. A Theory of Type Polymorphism in Programming. J. Comput. System Sci.(1978).
[45]
Mozilla Foundation. [n.d.]. Firefox. https://www.mozilla.org/en-US/firefox.
[46]
Mozilla Foundation. [n.d.]. Oxidation. https://wiki.mozilla.org/Oxidation. Accessed on 2021-05-14.
[47]
Santosh Nagarakatte, Jianzhou Zhao, Milo MK Martin, and Steve Zdancewic. 2009. SoftBound: Highly Compatible and Complete Spatial Memory Safety for C. In Proceedings of the 30th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI).
[48]
Santosh Nagarakatte, Jianzhou Zhao, Milo MK Martin, and Steve Zdancewic. 2010. CETS: Compiler-Enforced Temporal Safety for C. In Proceedings of the 2010 International Symposium on Memory Management (ISMM).
[49]
Tim Newsham. 2001. Format string attacks. http://hackerproof.org/technotes/format/formatstring.pdf.
[50]
Hamed Okhravi. 2021. A Cybersecurity Moonshot. IEEE Security & Privacy 19, 3 (2021), 8–16. https://doi.org/10.1109/MSEC.2021.3059438
[51]
Aleph One. 1996. Smashing The Stack For Fun And Profit. Phrack magazine (1996).
[52]
OpenBSD. 2003. OpenBSD 3.3.
[53]
Michalis Papaevripides and Elias Athanasopoulos. 2021. Exploiting Mixed Binaries. ACM Transactions on Privacy and Security (TOPS) (2021).
[54]
Soyeon Park, Sangho Lee, Wen Xu, Hyungon Moon, and Taesoo Kim. 2019. libmpk: Software Abstraction for Intel Memory Protection Keys (Intel MPK). In 2019 USENIX Annual Technical Conference (USENIX ATC 19).
[55]
PaX. 2003. PaX Address Space Layout Randomization.
[56]
Python Software Foundation. [n.d.]. The Python programming language. https://github.com/python/cpython.
[57]
Frédéric Recoules, Sébastien Bardin, Richard Bonichon, Laurent Mounier, and Marie-Laure Potet. 2019. Get rid of inline assembly through verification-oriented lifting. In 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE).
[58]
Eric Reed. 2015. Patina: A Formalization of the Rust Programming Language. University of Washington, Department of Computer Science and Engineering, Tech. Rep. UW-CSE-15-03-02(2015).
[59]
Rust Foundation. [n.d.]. Meet Safe and Unsafe - The Rustonomicon. https://doc.rust-lang.org/nomicon/meet-safe-and-unsafe.html. Accessed on 2021-05-14.
[60]
Rust Foundation. [n.d.]. Rust Programming Language. https://www.rust-lang.org.
[61]
Rust Foundation. [n.d.]. What is Ownership? - The Rust Programming Language. https://doc.rust-lang.org/book/ch04-01-what-is-ownership.html. Accessed on 2021-05-14.
[62]
David Schrammel, Samuel Weiser, Stefan Steinegger, Martin Schwarzl, Michael Schwarz, Stefan Mangard, and Daniel Gruss. 2020. Donky: Domain Keys–Efficient In-Process Isolation for RISC-V and x86. In 29th USENIX Security Symposium (USENIX Security 20).
[63]
Jeff Seibert, Hamed Okhravi, and Eric Soderstrom. 2014. Information Leaks Without Memory Disclosures: Remote Side Channel Attacks on Diversified Code. In Proceedings of the 21st ACM Conference on Computer and Communications Security (CCS’14) (Scottsdale, AZ).
[64]
Konstantin Serebryany, Derek Bruening, Alexander Potapenko, and Dmitriy Vyukov. 2012. AddressSanitizer: A Fast Address Sanity Checker. In 2012 USENIX Annual Technical Conference (USENIX ATC 12).
[65]
Hovav Shacham 2007. The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86). In ACM conference on Computer and communications security (CCS).
[66]
Dokyung Song, Julian Lettner, Prabhu Rajasekaran, Yeoul Na, Stijn Volckaert, Per Larsen, and Michael Franz. 2019. SoK: Sanitizing for Security. In 2019 IEEE Symposium on Security and Privacy (SP).
[67]
Chad Spensky, Aravind Machiry, Nathan Burow, Hamed Okhravi, Rick Housley, Zhongshu Gu, Hani Jamjoom, Christopher Kruegel, and Giovanni Vigna. 2021. Glitching Demystified: Analyzing Control-flow-based Glitching Attacks and Defenses. In 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). 400–412. https://doi.org/10.1109/DSN48987.2021.00051
[68]
Gregory T Sullivan, André DeHon, Steven Milburn, Eli Boling, Marco Ciaffi, Jothy Rosenberg, and Andrew Sutherland. 2017. The Dover Inherently Secure Processor. In 2017 IEEE International Symposium on Technologies for Homeland Security (HST).
[69]
Laszlo Szekeres, Mathias Payer, Tao Wei, and Dawn Song. 2013. SoK: Eternal War in Memory. In 2013 IEEE Symposium on Security and Privacy.
[70]
The Computer Language Benchmarks Game. [n.d.]. Rust vs C gcc fastest programs. https://benchmarksgame-team.pages.debian.net/benchmarksgame/fastest/rust.html. Accessed on 2021-05-14.
[71]
David Tolnay. [n.d.]. CXX - safe interop between Rust and C++. https://cxx.rs.
[72]
John Toman, Stuart Pernsteiner, and Emina Torlak. 2015. CRUST: A Bounded Verifier for Rust. In 2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE).
[73]
Anjo Vahldiek-Oberwagner, Eslam Elnikety, Nuno O Duarte, Michael Sammler, Peter Druschel, and Deepak Garg. 2019. ERIM: Secure, Efficient In-process Isolation with Protection Keys (MPK). In 28th USENIX Security Symposium (USENIX Security 19).
[74]
Robert Wahbe, Steven Lucco, Thomas E Anderson, and Susan L Graham. 1993. Efficient Software-Based Fault Isolation. In Proceedings of the fourteenth ACM symposium on Operating systems principles.
[75]
Bryan Ward, Richard Skowyra, Chad Spensky, Jason Martin, and Hamed Okhravi. 2019. The Leakage-Resilience Dilemma. In Proceedings of the 24th European Symposium on Research in Computer Security (ESORICS).
[76]
Jonathan Woodruff, Robert NM Watson, David Chisnall, Simon W Moore, Jonathan Anderson, Brooks Davis, Ben Laurie, Peter G Neumann, Robert Norton, and Michael Roe. 2014. The CHERI capability model: Revisiting RISC in an age of risk. In 2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA).
[77]
Bennet Yee, David Sehr, Gregory Dardyk, J Bradley Chen, Robert Muth, Tavis Ormandy, Shiki Okasaka, Neha Narula, and Nicholas Fullagar. 2009. Native Client: A Sandbox for Portable, Untrusted x86 Native Code. In 2009 30th IEEE Symposium on Security and Privacy.

Cited By

View all
  • (2025)SBD: Securing Safe Rust Automatically From Unsafe RustScience of Computer Programming10.1016/j.scico.2025.103281(103281)Online publication date: Feb-2025
  • (2024)An empirical study of rust-for-LinuxProceedings of the 2024 USENIX Conference on Usenix Annual Technical Conference10.5555/3691992.3692019(425-443)Online publication date: 10-Jul-2024
  • (2024)Semi-Automated Verification of Interior Unsafe Code Encapsulation in Real-World Rust SystemsProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering10.1145/3691620.3695373(2435-2437)Online publication date: 27-Oct-2024
  • Show More Cited By

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Other conferences
ACSAC '21: Proceedings of the 37th Annual Computer Security Applications Conference
December 2021
1077 pages
ISBN:9781450385794
DOI:10.1145/3485832
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike International 4.0 License.

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 06 December 2021

Check for updates

Qualifiers

  • Research-article
  • Research
  • Refereed limited

Conference

ACSAC '21

Acceptance Rates

Overall Acceptance Rate 104 of 497 submissions, 21%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)671
  • Downloads (Last 6 weeks)89
Reflects downloads up to 25 Feb 2025

Other Metrics

Citations

Cited By

View all
  • (2025)SBD: Securing Safe Rust Automatically From Unsafe RustScience of Computer Programming10.1016/j.scico.2025.103281(103281)Online publication date: Feb-2025
  • (2024)An empirical study of rust-for-LinuxProceedings of the 2024 USENIX Conference on Usenix Annual Technical Conference10.5555/3691992.3692019(425-443)Online publication date: 10-Jul-2024
  • (2024)Semi-Automated Verification of Interior Unsafe Code Encapsulation in Real-World Rust SystemsProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering10.1145/3691620.3695373(2435-2437)Online publication date: 27-Oct-2024
  • (2024)Rust for Embedded Systems: Current State and Open ProblemsProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security10.1145/3658644.3690275(2296-2310)Online publication date: 2-Dec-2024
  • (2024)Manipulative Interference AttacksProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security10.1145/3658644.3690246(4569-4583)Online publication date: 2-Dec-2024
  • (2024)When Is Parallelism Fearless and Zero-Cost with Rust?Proceedings of the 36th ACM Symposium on Parallelism in Algorithms and Architectures10.1145/3626183.3659966(27-40)Online publication date: 17-Jun-2024
  • (2024)Demystifying Compiler Unstable Feature Usage and Impacts in the Rust EcosystemProceedings of the IEEE/ACM 46th International Conference on Software Engineering10.1145/3597503.3623352(1-13)Online publication date: 20-May-2024
  • (2024)Yuga: Automatically Detecting Lifetime Annotation Bugs in the Rust LanguageIEEE Transactions on Software Engineering10.1109/TSE.2024.344767150:10(2602-2613)Online publication date: 22-Aug-2024
  • (2024)TECS/Rust: Memory-safe Component Framework for Embedded Systems2024 IEEE 27th International Symposium on Real-Time Distributed Computing (ISORC)10.1109/ISORC61049.2024.10551370(1-11)Online publication date: 22-May-2024
  • (2024)System Call Interposition Without Compromise2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)10.1109/DSN58291.2024.00030(183-194)Online publication date: 24-Jun-2024
  • Show More Cited By

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

HTML Format

View this article in HTML Format.

HTML Format

Login options

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media