CGuard: Efficient Spatial Safety for C

TL;DR

CGuard is a novel tool that enforces spatial safety in C applications efficiently, supporting large address spaces by encoding bounds information within object memory layouts, thus preventing security violations with manageable overheads.

Contribution

CGuard introduces a new method for object-bounds protection in C that supports 64-bit address spaces without high overheads, improving upon prior object-based approaches like SGXBounds.

Findings

Detected spatial safety violations in SPEC CPU2017 and Phoenix benchmarks.

Overheads of 42% and 26% on SPEC CPU2017 and Phoenix benchmarks respectively.

30% throughput reduction in saturated Apache webserver scenario.

Abstract

Spatial safety violations are the root cause of many security attacks and unexpected behavior of applications. Existing techniques to enforce spatial safety work broadly at either object or pointer granularity. Object-based approaches tend to incur high CPU overheads, whereas pointer-based approaches incur both high CPU and memory overheads. SGXBounds, an object-based approach, is so far the most efficient technique that provides complete out-of-bounds protection for objects. However, a major drawback of this approach is that it can't support address space larger than 32-bit. In this paper, we present CGuard, a tool that provides object-bounds protection for C applications with comparable overheads to SGXBounds without restricting the application address space. CGuard stores the bounds information just before the base address of an object and encodes the relative offset of the base address in the spare bits of the virtual address available in x86_64 architecture. For an object that can't fit in the spare bits, CGuard uses a custom memory layout that enables it to find the base address of the object in just one memory access. Our study revealed spatial safety violations in the gcc and x264 benchmarks from the SPEC CPU2017 benchmark suite and the string_match benchmark from the Phoenix benchmark suite. The execution time overheads for the SPEC CPU2017 and Phoenix benchmark suites were 42% and 26% respectively, whereas the reduction in the throughput for the Apache webserver when the CPUs were fully saturated was 30%. These results indicate that CGuard can be highly effective while maintaining a reasonable degree of efficiency.