https://arxiv.org/abs/2107.10533

close this message

Donate to arXiv

Please join the Simons Foundation and our generous member
organizations in supporting arXiv during our giving campaign
September 23-27. 100% of your contribution will fund improvements and
new initiatives to benefit arXiv's global scientific community.

DONATE

[secure site, no need to create account]

Skip to main content
Cornell University
We gratefully acknowledge support from
the Simons Foundation and member institutions.
 
arXiv.org > cs > arXiv:2107.10533
[                    ]

Help | Advanced Search

[All fields        ]
Search
arXiv
Cornell University Logo
[                    ] GO
quick links

  * Login
  * Help Pages
  * About

Computer Science > Cryptography and Security

arXiv:2107.10533 (cs)
[Submitted on 22 Jul 2021]

Title:CGuard: Efficient Spatial Safety for C

Authors:Piyus Kedia, Rahul Purandare, Udit Kumar Agarwal, Rishabh
Download PDF

    Abstract: Spatial safety violations are the root cause of many
    security attacks and unexpected behavior of applications.
    Existing techniques to enforce spatial safety work broadly at
    either object or pointer granularity. Object-based approaches
    tend to incur high CPU overheads, whereas pointer-based
    approaches incur both high CPU and memory overheads. SGXBounds,
    an object-based approach, is so far the most efficient technique
    that provides complete out-of-bounds protection for objects.
    However, a major drawback of this approach is that it restricts
    the application address space to 4GB.
    In this paper, we present CGuard, a tool that provides
    object-bounds protection for C applications with comparable
    overheads to SGXBounds without restricting the application
    address space. CGuard stores the bounds information just before
    the base address of an object and encodes the relative offset of
    the base address in the spare bits of the virtual address
    available in x86_64 architecture. For an object that can't fit in
    the spare bits, CGuard uses a custom memory layout that enables
    it to find the base address of the object in just one memory
    access. Our study revealed spatial safety violations in the gcc
    and x264 benchmarks from the SPEC CPU2017 benchmark suite and the
    string_match benchmark from the Phoenix benchmark suite. The
    execution time overheads for the SPEC CPU2017 and Phoenix
    benchmark suites were 44% and 25% respectively, whereas the
    reduction in the throughput for the Apache webserver when the
    CPUs were fully saturated was 30%. These results indicate that
    CGuard can be highly effective while maintaining a reasonable
    degree of efficiency.

Subjects: Cryptography and Security (cs.CR); Programming Languages
          (cs.PL); Software Engineering (cs.SE)
Cite as:  arXiv:2107.10533 [cs.CR]
          (or arXiv:2107.10533v1 [cs.CR] for this version)

Submission history

From: Piyus Kedia [view email]
[v1] Thu, 22 Jul 2021 09:09:37 UTC (2,519 KB)
Full-text links:

Download:

  * PDF
  * Other formats

(license)
Current browse context:
cs.CR
< prev   |   next >
new | recent | 2107
Change to browse by:
cs
cs.PL
cs.SE

References & Citations

  * NASA ADS
  * Google Scholar
  * Semantic Scholar

a export bibtex citation Loading...

Bibtex formatted citation

x
[loading...          ]
Data provided by:

Bookmark

BibSonomy logo Mendeley logo Reddit logo ScienceWISE logo
(*) Bibliographic Tools

Bibliographic and Citation Tools

[ ] Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
[ ] Litmaps Toggle
Litmaps (What is Litmaps?)
( ) Code & Data

Code and Data Associated with this Article

[ ] arXiv Links to Code Toggle
arXiv Links to Code & Data (What is Links to Code & Data?)
( ) Related Papers

Recommenders and Search Tools

[ ] Connected Papers Toggle
Connected Papers (What is Connected Papers?)
[ ] Core recommender toggle
CORE Recommender (What is CORE?)
( ) About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and
share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have
embraced and accepted our values of openness, community, excellence,
and user data privacy. arXiv is committed to these values and only
works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?
Learn more about arXivLabs and how to get involved.

Which authors of this paper are endorsers? | Disable MathJax (What is
MathJax?)

  * About
  * Help

  * Click here to contact arXiv Contact
  * Click here to subscribe Subscribe

  * Copyright
  * Privacy Policy

  * Web Accessibility Assistance
  * arXiv Operational Status
    Get status notifications via email or slack