HeapSentry: Kernel-assisted Protection against Heap Overflows

The last twenty years have witnessed the constant reaction of the security com-munity to memory corruption attacks and the evolution of attacking techniques in order to circumvent the newly-deployed countermeasures. In this evolution, the heap of a process received little attention and thus today, the problem of heap overflows is largely unsolved. In this paper we present HeapSentry, a system designed to detect and stop heap overflow attacks through the cooperation of the memory allocation library of a program and the operating system’s kernel. HeapSentry places unique ran-dom canaries at the end of each heap object which are later checked by the kernel, before system calls are allowed to proceed. HeapSentry operates on bina-ries (no source code needed) and has, by design, no false-positives. At the same time, the active involvement of the kernel provides stronger security guarantees than the current state of the art in heap protection mechanisms for a modest performance overhead.