The developers of the Chromium project 912 dangerous and critical vulnerabilities have been identified in stable releases of Chrome since 2015, concluding that 70% of them were due to unsafe memory handling (pointer errors in C/C++ code). Half of these issues (36.1%) are caused by buffer accesses after the associated memory has been freed (use-after-free).
When designing Chromium, it was originally , that the code would inevitably contain errors, so a significant emphasis was placed on applying sandbox isolation to limit the consequences of vulnerabilities. Currently, the capabilities of this technology have reached their limits, and further decomposition into processes is impractical from a resource consumption standpoint.
To maintain the security of the codebase, Google also employs the "", which states that any code added must fall under no more than two of three conditions: working with untrusted input, using an unsafe programming language (C/C++), and executing with elevated privileges. From this rule, it follows that code handling external data must either be limited to minimal privileges (isolated) or be written in a safe programming language.
To further enhance the security of the codebase, a project has been initiated to prevent memory handling errors within the codebase. Three main approaches are highlighted: creating C++ libraries with functions for safe memory handling and expanding the garbage collector's scope, applying hardware protection mechanisms (Memory Tagging Extension), and writing components in languages that ensure safe memory handling (Java, Kotlin, JavaScript, Rust, Swift).
It is expected that the work will focus on two directions:
- Significant changes in the C++ development process, which may negatively impact performance (additional boundary checks and garbage collection). Instead of raw pointers, it is proposed to use a type , allowing the exploitation of use-after-free errors to result in non-security-threatening crashes, without significant negative impact on performance, memory consumption, and stability.
- The use of languages designed to perform safe memory checks at compile time (will help avoid the negative performance impact characteristic of such checks during runtime, but will lead to additional costs for organizing interaction between the new language code and C++ code).
Using libraries for safe memory management is the simplest yet least effective approach. Rewriting code in Rust is considered the most effective but also a very costly method.
Source: opennet.ru
