arXiv (Cornell University)
Binary Debloating for Security via Demand Driven Loading
February 2019 • Girish Mururu, Chris Porter, Prithayan Barua, Santosh Pande
Modern software systems heavily use C/C++ based libraries. Because of the weak memory model of C/C++, libraries may suffer from vulnerabilities which can expose the applications to potential attacks. For example, a very large number of return oriented programming gadgets exist in glibc that allow stitching together semantically valid but malicious Turing-complete programs. In spite of significant advances in attack detection and mitigation, full defense is unrealistic against an ever-growing set of possibilities f…