Abstract:Due to rapid technology advance, cyber-physical system (CPS) plays increasingly important rules in society, such as power system and railway system. However, if these systems are attacked, it would be a serious problem for the world even threats human lives. Dangling pointers is such kind of software defects and can lead to use-after-free and double-free vulnerabilities, which can be leveraged by attackers. So far, only a few approaches have been proposed to protect against dangling pointers, while most of them suffer from high overhead. This paper study proposes a lightweight approach, named DangDone, to detect dangling pointers dynamically. Built upon the root cause of a dangling pointer, i.e., a pointer and its aliases are not nullified but the memory area they point to is deallocated. DangDone first detects dangling pointers by static analysis and fuzzing. Based on the result, DangDone realizes the detection by inserting an intermediate pointer between the pointers (i.e., a pointer and its aliases) and the memory area they point to. Hence, nullifying the intermediate pointer will nullify the pointer and its aliases, which causes crash when encountering use-after-free or double-free. Experimental results have demonstrated that DangDone introduces negligible runtime overhead (i.e., around 1% on average) on SPEC CPU benchmark and is able to protect 11 real-world use-after-free or double-free vulnerabilities. The evaluation demonstrates the efficiency and effectiveness of DangDone.