PMDangNull: Preventing use-After-Free for Persistent Memory Applications

PMO Checker: A Framework for Protecting Persistent Memory Objects Against Security Attacks

As a new abstraction to manage persistent data in non-volatile memory, Persistent Memory Objects (PMOs) hold (pointer-rich) data structures that can be shared among processes over many runs and system boots. While convenient and fast, such sharing opens up a new class of attacks that attempt to break inter-process isolation, allowing the attacker to compromise a non-vulnerable process through a different process and a shared PMO. Due to the difficulty in completely preventing or avoiding security attacks, we present PMO Checker, a comprehensive framework for detecting and recovering from them. Our framework includes various invariant checking and checkpointing schemes. We implement them on a real system with Linux kernel on a real platform with Intel Optane PMem memory. Our evaluation shows the effectiveness of the attack detection and various performance optimizations that keep the overheads low.

Melting the Flesh of PHP’s Memory Hardening

User Privacy Attacks through Self-Modifying Code Conflicts

Self-modifying code (SMC) is a specialized technique that alters program execution by modifying instructions in executable memory pages during runtime. While historically employed for performance tuning, dynamic optimization, and obfuscation, both x86 and RISC-V-based processors continue to support SMC as part of their architectural flexibility. However, the same capability that enables adaptive and high-performance execution also opens the door for novel microarchitectural exploitation. In particular, SMC allows attackers to induce distinctive instruction fetch and cache behaviors, thereby enabling precise monitoring of shared microarchitectural resources such as instruction caches. In this paper, we present the first in-depth security study of SMC on the latest Intel microarchitectures, including the latest hybrid CPU designs that balance performance and energy efficiency. We systematically analyze a set of x86 instructions that directly or indirectly invalidate instruction cache lines, revealing measurable timing asymmetries between cache hits and misses. Our results show that these SMC-induced timing artifacts can be leveraged to mount high-resolution cache attacks that are both stealthier and more reliable than traditional techniques. We demonstrate the power of our approach through two privacy-violating case studies: (1) recovering victim keystrokes with high accuracy in real time, and (2) performing website fingerprinting on hyper-threaded CPU cores, successfully targeting both the Google Chrome and Tor browsers. Beyond empirical results, we explore the architectural conditions that amplify SMC side effects, discuss the broader implications for multi-tenant and browser-based environments, and give an overview of possible hardware and software-level countermeasures.

PTSan: A Practical Memory Safety Sanitizer for C/C++ with Pointer-Object Authority

Memory safety errors remain the dominant source of severe vulnerabilities in C and C++. Pointer-based sanitizers provide stronger guarantees than location-based tools such as LLVM's ASan, but their overhead and compatibility limitations have constrained production use. We present PTSan, an LLVM sanitizer that makes pointer-based checking practical by storing an object identifier in each pointer's high bits and its bounds in a fixed-size runtime table. This representation trades a finite live-object budget for low overhead, optimizer visibility, and commodity-hardware support. Because identity travels with the pointer value, ordinary LLVM dataflow propagates it without explicit per-pointer metadata instructions. Separating metadata lookup from check enforcement exposes both as LLVM IR, enabling check hoisting, elision, and merging, plus whole-function min-cut placement of compatibility tag strips. Intel Linear Address Masking eliminates the remaining strips in hardware when available. On stock hardware PTSan runs at parity with the fastest published location-based sanitizer: 57.2% geomean overhead on SPEC CPU 2017 on x86-64 (46.4% with Intel LAM), 54.7% on ARM64, and 31.5% (x86-64) on the application-shaped LLVM MultiSource suite. This is roughly a third of the published overhead percentage of prior systems with similar pointer-object authority guarantees, while preserving the inter-object, non-object, and temporal detection coverage measured by an independent memory safety test suite. Its physical-memory overhead is effectively native, a critical property for production deployment as memory costs become a first-order constraint. We also demonstrate practical overhead on real-world server and security workloads. These results show that PTSan brings practical pointer-based memory safety into a recompile-only sanitizer deployment model.

Supporting Memory Safety with a Security-Enhanced Memory Controller

: Memory-unsafe languages such as C and C ++ remain widely used because they provide low-level control and high performance, but they remain vulnerable to spatial and temporal memory-safety violations such as out-of-bounds accesses, buffer overflows, and use-after-free errors. Prior hardware-assisted defenses reduce software overhead, yet many still rely on CPU-side metadata checks that add latency to the critical path and often miss DMA-originated accesses. We show that metadata-access cost is not dominated solely by DRAM latency: a substantial portion of the delay comes from on-chip traversal and cache-related processing. Motivated by this result, we propose SerMC, a memory-controller-based tripwire mechanism that validates accesses when metadata arrives from Dynamic Random Access Memory (DRAM) and extends enforcement to DRAM-bound accesses issued by both processors and DMA-capable devices. SerMC keeps metadata checks off the CPU critical path while preserving compatibility with existing C/C ++ programs. The design targets spatial and temporal violations that cross tripwire-protected DRAM regions; non-linear pointer corruption that avoids such regions and microarchitectural side channels remain outside the scope of the current design. Our evaluation on selected SPEC CPU workloads shows 9.25% average performance overhead, while the most memory-intensive workloads incur slowdowns of up to 50%. These results indicate that SerMC provides practical average-case overhead but still exposes a clear worst-case tradeoff when metadata traffic competes with demand memory requests.

Stack integrity for practical code-reuse attack defense

StackPatroller is proposed, a stack-integrity-based runtime supervision framework that enforces program integrity through configurable policies that monitors runtime stack contexts to detect early deviations from normal execution, enabling the identification of whole-function reuse and certain forward-edge attacks earlier—within user mode before any unintended system calls occur.