Detecting Double Free With BPF - Bojun Seo, LG Electronics

Detecting Double Free With BPF - Bojun Seo, LG Electronics

Double free vulnerabilities remain a critical security and safety issue in C and C++ programs. These errors, where memory is freed multiple times, can lead to crashes or exploitable security flaws. Developers usually rely on static and dynamic analysis tools, which effectively catch most issues during testing. However, detecting double frees in production environments, particularly in embedded systems, is challenging. The reason is that conventional debugging tools often alter the memory footprint and introduce significant overhead, frequently failing to reproduce the issue due to these changes, so-called Heisenbug.

This talk introduces a novel double free detection tool leveraging BPF(Berkeley Packet Filter). By collecting data in a separate process, this tool preserves the target process’s memory footprint, minimizing interference. With significantly lower overhead compared to traditional debugging tools, it enhances the reliability of detecting double frees in production, especially in performance-sensitive embedded systems. I will demonstrate how BPF’s lightweight tracing capabilities improve memory safety, offering an effective solution for real-world double free detection.

Видео Detecting Double Free With BPF - Bojun Seo, LG Electronics канала The Linux Foundation