Dynamic Memory Handling in C/C++

Secure Memory Handling: Dynamic Memory Heap

• Heap memory is managed by the developer at runtime
• The kernel fulfills memory allocation and deallocation requests
• The heap is tracked in units of chunks
• Chunk sizes are not fixed, and vary based on requests
• The first-fit algorithm is used to find the first free chunk large enough
• Heap allocation/deallocation
  • Use malloc() or new to allocate memory as a chunk
  • Use free() or delete to deallocate memory
    • Freed chunks can be reused
• Example C code: (char*)malloc(80); // 80 bytes allocated
• Example C++ code: char* str = new char[80]; // 80 bytes allocated - delete [] str; to deallocate
• Classes using dynamic memory must adhere to the rule of three
  • Copy Constructor: allocates new heap memory for data members and copies data from one object to the new object.
  • Assignment Operator: allocates new heap memory for data members and copies data from one object to another.
  • Destructor: destroys all allocated heap memory when the object goes out of scope.

Heap Memory Vulnerabilities

• Invalid Free/Uninitialized Exploits:
  • Invalid free: deleting a chunk not previously allocated
  • Uninitialized reads: blindly reading from a newly allocated heap
• Heap Overflow/Underflow:
  • Attack buffer is on the heap, exceeding allocated chunk size
  • Memory is requested by programs for dynamic data structures
  • Typically located above program code
  • No return address; no easy transfer of control
  • May manipulate management data structures. Potentially exploit function pointers
  • Defense Strategies:
    • Make the heap non-executable.
    • Randomize memory allocation
• Dangling Pointers:
  • Occurs when a program frees a heap chunk but later tries to use it.
  • Referencing freed memory can cause crashes, unexpected values, or code execution.
• Use-After-Free Vulnerability:
  • Involves incorrect use of dynamic memory during program operation.
  • If a program doesn't clear a pointer after freeing memory, an attacker can exploit this error to hack the program. This error can also happen if a program attempts to use freed memory, but the memory has not yet been fully reused or cleared.
  • Example: Allocate, free, then reallocate the same chunk with crafted data, potentially allowing for access control violations. Malicious data or crafted data could be placed into freed memory. Reallocation of the same chunk can occur (e.g., chunk 0x9214008 previously freed twice, then reallocated twice).

Use-After-Free Vulnerability (CWE)

• Referencing memory after it's freed leads to program crashes, data corruption, or code execution.
• Reusing freed memory is a common corruption method.
• Causes typically include error conditions (e.g., unexpected exceptions) and confusion regarding who is responsible for freeing allocated memory.

Consequences of Use-After-Free

• Integrity:
  • Using memory from a freed block can corrupt valid data elsewhere if that data area has been successfully previously allocated and used.
• Availability:
  • Chunk consolidation after using freed memory can cause program crashes due to use of invalid data; e.g., memory from freed chunks might be reallocated in an unexpected manner
• Access Control:
  • Malicious data entered before chunk consolidation could potentially trigger code execution by exploiting write-what-where primitives.

Mitigate Use-After-Free

• Smart Pointers (Modern C++):
  • unique_ptr<T>: Ownership; only one pointer.
  • shared_ptr<T>: Reference counting; multiple pointers.
  • weak_ptr<T>: Avoids circular references.
  • Using unique_ptr might make the use-after-free vulnerability harder to exploit

Double Free

• If the same memory chunk is freed twice, it may be reallocated.
• This can have unexpected effects on memory management. Example: chunk 0x9214008 may be reallocated twice after being freed twice.

Heap Vulnerability Mitigations

• Strategies:
  • AddressSanitizer and MemorySanitizer (tools) detect uninitializes reads and overflows/use-after-free. AddressSanitizer incurs a 73% slowdown with a 3.4x memory overhead, MemorySanitizer incurs a 2.5x slowdown with a 2x memory overhead.
  • Heap Therapy proposes efficient heap overflow detection, but doesn't protect against uninitialized reads or use-after-free vulnerabilities.

Memory Management Errors

• Initialization Errors: Failing to check return values (e.g., of malloc)
• Writing to Freed Memory: Writing data to memory location that was free.
• Freeing Same Memory Twice: Attempting to free space already freed.
• Improperly Paired Functions (malloc/delete): Inconsistencies with matching memory allocation and deallocation functions.
• Failure to Distinguish Scalars/Arrays: Misinterpreting data types (e.g., treating an array as a single scalar variable).
• Improper Allocation Function Use: Incorrect or inappropriate use of memory allocation functions.

Heap Guidelines

• Use only allocated memory
• Free allocated memory only once after use.
• Avoid accessing freed memory.
• Check malloc's return results for errors (e.g., return value of NULL).
• Don't make assumptions about the state of memory returned by malloc.
• Initialize pointers to NULL after freeing them.
• Zero-out sensitive data before freeing.
• Don't use dynamically allocated memory after initialization for critical systems.