Programmer Errors

• Buffer Overflow.
• Off by one
• Incomplete Mediation: Non-sanitized input
  • Robert Oot
  • 
• Time to Check vs Time of Use
  • A synchronization problem
    • You check or validate a credential (or other item)
    • Time goes by
    • Then you use it.
  • This could be a shell game
    • Mad Max wants to buy something so he shows me a $20, which I verify
    • I then look up the price of the item, calculate the change and count it out.
    • While I am doing this, Max swaps his $20 for a $1.
    • I take the $1 and give the change.
• Undocumented access point
  • Back door.
  • Frequently used during program development.
  • A problem when the programmer forgets to remove it.
• Integer overflow
  • Therac-25
    • Computer Controlled radiation therapy machine.
    • Killed people.
    • Among other things

    • char error_flag = 0;
      ....
      // many cases of this in the code
      if (error) {
         error_flag ++;
      }
      
      ...
      if (error_flag <= 0) {
          Do_Radiation_Therapy();
      }
                    

• Unterminated NULL-Terminated string.
  • Will allow buffer overflow like errors.
• Race conditions
  • In parallel programming when two (or more) processes want the same resource.

  • time
      |      Process 1 asks if memory is available
      v      Process 1 gets a yes back
             Process 1 is interrupted
             Process 2 asks for memory
             Process 2 gets a yes back
             Process 2 requests  memory
             Process 1 requests memory
    
              

• A final example: Dirty Cow
  • A combination of a race condition and check vs use
  • A kernel vulnerability
    • Introduced into the linux kernel in 2007
    • Identified and fixed.
    • Reintroduced later.
    • Last time Identified in 2016
  • Idea: A memory mapped files
    • We can "map" a file to memory.
    • void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset);
      • Address where it will be mapped
        • if NULL one will be selected for you. This is returned
        • This is actually a page in memory.
        • This is a "copy" of the file.
        • This is reflected in /proc/sys/vm/mmap
        • And /proc/self/mem
      • The size of the file to be mapped
      • The memory protection
        • PROT_WRITE | PROT_READ means for read and write
    • flags indicate how the map will be used
      • MAP_SHARED Updates to the map are visible to other processes and are reflected in the file.
      • MAP_PRIVATE
        • Create a private copy on write map.
        • Updates are applied to the file but not visible to other processes
          • The file is "mapped" to memory.
          • When this process writes for the first time
            • New memory is allocated (a private copy)
            • The data is copied over
            • The write is performed on the new private copy.
    • madvise tells the OS that the memory is no longer needed.
      • So the private copy will be discarded.
      • And the map will point back to the shared copy.
    • Generally you can't write to files /mapped memory marked read only .
      • But with a private map you can, because this is not written back to the file.
    • So Copy on write
      1. Make a copy of the memory
      2. Change the pointer to point to that memory
      3. Check permission to write
      4. Do the write
    • So madvise (MADV_DONTNEED)
      1. move the pointer back to the shared map
      2. discard the new memory page.
    • The problem is when the permissions are checked.
      • If steps occur in this order

        A B C a D ...
                          

        the library has a bug and the user will write the file.
• How to fix these
  • Patch your os.
  • Code Review
  • Test Your Code, many cases
  • Use best practices.
  • Use good tools.