Although numerous defenses against memory vulnerability exploits have been studied so far, highly-compatible, precise, and efficient defense is still an open problem. In fact, existing defense methods have at least one of the following problems: they (1) cannot precisely protect structure fields, (2) incur high protection overheads, and/or (3) cannot maintain compatibility with existing code due to imposing memory layout change on the protected program. In this paper, we propose a novel memory-protection method FIX-Sense that aims to solve all of these problems simultaneously. Our key idea is to perform memory protection based on field-sensitive data-flow integrity. Specifically, our method (1) computes a safe write-read relation for each memory object, at the structure-field granularity, based on field-sensitive value-flow analysis at the compile-time of the protected program. (2) At run-time, lightweight verification is performed to determine whether each memory read executed by the protected program belong to the safe write-read relation calculated for the memory object at compile time. (3) This verification is implemented by lightweight metadata management that tracks memory writes at the structure field granularity without changing the memory layout of the target program (especially the structure field layout).

翻译：尽管针对内存漏洞利用的防御措施已得到广泛研究，但高兼容性、高精度且高效的防御仍是一个开放性问题。事实上，现有防御方法至少存在以下问题之一：（1）无法精确保护结构体字段；（2）产生较高的防御开销；和/或（3）因改变受保护程序的内存布局而无法与现有代码保持兼容。本文提出了一种新型内存保护方法FIX-Sense，旨在同时解决上述所有问题。其核心思想是基于域敏感的数据流完整性执行内存保护。具体而言，该方法（1）在受保护程序编译时，通过域敏感的值流分析，以结构体字段为粒度，为每个内存对象计算安全的写-读关系；（2）在运行时执行轻量级验证，判断受保护程序执行的每次内存读取是否属于编译时为该内存对象计算的安全写-读关系；（3）该验证通过轻量级元数据管理实现，该管理机制以结构体字段粒度为粒度追踪内存写入，且无需改变目标程序（尤其是结构体字段布局）的内存布局。