Google Enhances Linux Security with Counted_By Attribute for Flexible Array Members

Google Enhances Linux Security with Counted_By Attribute for Flexible Array Members

Google has introduced the counted_by attribute for flexible array members, aiming to improve Linux security by addressing a significant vulnerability in C programming related to buffer overflows. This enhancement focuses on flexible array members, which are particularly challenging as their sizes are determined at runtime, making them susceptible to buffer overflows.

Buffer Overflow Challenges and Solution

Buffer overflows have been a persistent security issue in software development. While sanitizers have helped mitigate some of these vulnerabilities by automatically inserting bounds checking, flexible array members have remained problematic. Their sizes are typically opaque to the compiler, complicating bounds checking outside the allocation function. Google’s solution, implemented in Clang and GCC, introduces the counted_by attribute, which explicitly references the field storing the number of elements in a flexible array member. This enables the array bounds sanitizer to verify operations on these arrays, creating an implicit relationship between the array and the count field, thus enhancing the detection of potential overflows.

Rules for Using Counted_By Attribute

To effectively use the counted_by attribute, developers must follow these specific rules:

1. The count field must be within the same non-anonymous, enclosing struct as the flexible array member.
2. The count field must be set before any array access.
3. The array field must always have at least the count number of elements available.
4. The count field may change but must never exceed the number of elements originally allocated.

Impact on Linux Kernel Security

This attribute has significant implications for fortification, an ongoing project to enhance Linux kernel security by preventing buffer overflows in memory and string operations. Fortification relies on built-in functions like __builtin_object_size() and __builtin_dynamic_object_size() to validate input sizes. With the counted_by attribute, these functions can now accurately determine the size of flexible array members, further improving security.

Current and Future Applications

Already in use within the Linux kernel, the counted_by attribute has been instrumental in catching issues such as integer overflows that lead to heap buffer overflows. Google plans to expand its application to more flexible array members and enforce its use in future developments, demonstrating its commitment to fortifying Linux security.

By addressing a critical vulnerability in C programming, Google's counted_by attribute marks a significant step forward in enhancing the security of Linux systems.