@kazani

Exploring GrapheneOS secure allocator: Hardened Malloc GrapheneOS, a privacy and security-focused mobile operating system based on Android, has introduced hardened malloc, a secure allocator designed to protect against memory corruption vulnerabilities. This article delves into the internal architecture and security mechanisms of hardened malloc, providing a detailed analysis for security researchers and exploit developers. The study was conducted on two GrapheneOS devices, with the source code obtained from the official GrapheneOS GitHub repository. GrapheneOS extends the address space for userland processes to 48 bits and increases ASLR entropy to 33 bits, enhancing the security of its memory allocator. The article also discusses the use of Memory Tagging Extension (MTE), an ARM architecture extension that prevents memory corruption by tagging memory regions. Hardened malloc leverages MTE on compatible smartphones to prevent out-of-bounds reads/writes and use-after-free vulnerabilities. The allocator isolates metadata from user data in separate memory regions and uses a two-stage quarantine system to delay the reuse of freed slots, adding a layer of non-determinism and complexity to use-after-free exploits. For large allocations, hardened malloc uses randomly sized guard pages to prevent overflows and isolate memory regions. Overall, hardened malloc significantly reduces opportunities for exploiting memory corruption vulnerabilities, making it a robust security feature for GrapheneOS. https://www.synacktiv.com/en/publications/exploring-grapheneos-secure-allocator-hardened-malloc

1 reply

0 recast

0 reaction