MEDS: The Memory Error Detection System

  • Jason D. Hiser
  • Clark L. Coleman
  • Michele Co
  • Jack W. Davidson
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5429)


Memory errors continue to be a major source of software failure. To address this issue, we present MEDS (Memory Error Detection System), a system for detecting memory errors within binary executables. The system can detect buffer overflow, uninitialized data reads, double-free, and deallocated memory access errors and vulnerabilities. It works by using static analysis to prove memory accesses safe. If a memory access cannot be proven safe, MEDS falls back to run-time analysis. The system exceeds previous work with dramatic reductions in false positives, as well as covering all memory segments (stack, static, heap).


Memory Error Benchmark Suite Buffer Overflow Object Code False Positive Report 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Aho, A.V., Sethi, R., Ullman, J.D.: Compilers: Principles, Techniques, and Tools. Addison-Wesley, Reading (1986)zbMATHGoogle Scholar
  2. 2.
    Kumar, N., Misurda, J., Childers, B.R., Soffa, M.L.: Instrumentation in software dynamic translators for self-managed systems. In: Proceedings of the 1st ACM SIGSOFT Workshop on Self-managed Systems, pp. 90–94. ACM Press, New York (2004)CrossRefGoogle Scholar
  3. 3.
    Zhou, S., Childers, B.R., Soffa, M.L.: Planning for code buffer management in distributed virtual execution environments. In: VEE 2005: Proceedings of the 1st ACM/USENIX International Conference on Virtual Execution Environments, pp. 100–109. ACM Press, New York (2005)CrossRefGoogle Scholar
  4. 4.
    Scott, K., Davidson, J.: Strata: A software dynamic translation infrastructure. In: IEEE Workshop on Binary Translation. IEEE, Los Alamitos (2001)Google Scholar
  5. 5.
    Scott, K., Kumar, N., Childers, B., Davidson, J.W., Soffa, M.L.: Overhead reduction techniques for software dynamic translation. In: Proceedings of the 18th International Parallel and Distributed Processing Symposium, p. 200. IEEE, Los Alamitos (2004)Google Scholar
  6. 6.
    Scott, K., Kumar, N., Velusamy, S., Childers, B., Davidson, J.W., Soffa, M.L.: Retargetable and reconfigurable software dynamic translation. In: CGO 2003: Proceedings of the International Symposium on Code Generation and Optimization, Washington, DC, USA, pp. 36–47. IEEE Computer Society Press, Los Alamitos (2003)Google Scholar
  7. 7.
    Eagle, C.: The IDA Pro Book. No Starch Press, San Francisco (2008)Google Scholar
  8. 8.
    Hening, J.L.: SPEC CPU2000: Measuring CPU performance in the new millennium. IEEE Computer 7, 28–35 (2000)CrossRefGoogle Scholar
  9. 9.
    Black, P.E.: Software assurance metrics and tool evaluation. In: Proceedings of the 2005 International Conference on Software Engineering Research and Practice (2005)Google Scholar
  10. 10.
    Poe, J., Li, T.: Bass: A benchmark suite for evaluating architectural security systems. In: SIGARCH Computer Architecture News, pp. 26–33. ACM Press, New York (2006)Google Scholar
  11. 11.
    Wilander, J., Kamkar, M.: A comparison of publicly available tools for dynamic buffer overflow prevention. In: Proceedings of the Network and Distributed System Security Symposium, pp. 149–162. Internet Society (2003)Google Scholar
  12. 12.
    Benitez, M.E., Davidson, J.W.: The advantages of machine-dependent global optimization. In: Proceedings of the 1994 Conference on Programming Languages and Systems Architectures, pp. 105–124. ACM, New York (1994)Google Scholar
  13. 13.
    Nethercote, N., Fitzhardinge, J.: Bounds checking entire programs without recompiling. In: Informal Proceedings of the Second Workshop on Semantics, Program Analysis, and Computing Environments for Memory Management (SPACE 2004) (2004)Google Scholar
  14. 14.
    Barrantes, E.G., Ackley, D.H., Forrest, S., Stefanovic, D.: Randomized instruction set emulation. ACM Transactions on Information Systems Security 8, 3–40 (2005)CrossRefGoogle Scholar
  15. 15.
    Baratloo, A., Singh, N., Tsai, T.: Transparent run-time defense against stack smashing attacks. In: Proceedings of the USENIX Annual Technical Conference, pp. 251–262. USENIX (2000)Google Scholar
  16. 16.
    Liang, Z., Sekar, R., DuVarney, D.C.: Automatic synthesis of filters to discard buffer overflow attacks: A step towards self-healing systems. In: Usenix 2005 Annual Technical Conference, pp. 375–378 (2005)Google Scholar
  17. 17.
    Ruwase, O., Lam, M.: A practical dynamic buffer overflow detector. In: Proceedings of the Network and Distributed System Security (NDSS) Symposium, pp. 159–169 (2004)Google Scholar
  18. 18.
    Kc, G.S., Keromytis, A.D., Prevelakis, V.: Countering code-injection attacks with instruction-set randomization. In: CCS 2003: Proceedings of the 10th ACM conference on Computer and communications security, pp. 272–280. ACM Press, New York (2003)Google Scholar
  19. 19.
    Cowan, C., Barringer, M., Beattie, S., Kroah-Hartman, G., Frantzen, M., Lokier, J.: FormatGuard: Automatic protection from printf format string vulnerabilities. In: Proceedings of 10th USENIX Security Symposium, pp. 191–200 (2001)Google Scholar
  20. 20.
    Cowan, C., Pu, C., Maier, D., Hinton, H., Bakke, P., Beattie, S., Grier, A., Wagle, P., Zhang, Q.: Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks. In: Proceedings of the 7th USENIX Security Symposium. pp. 26–29. USENIX (1998) Google Scholar
  21. 21.
    Necula, G.C., McPeak, S., Weimer, W.: Ccured: Type-safe retrofitting of legacy code. In: POPL 2002: Proceedings of the 29th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 128–139. ACM Press, New York (2002)Google Scholar
  22. 22.
    Akritidis, P., Cadar, C., Raiciu, C., Costa, M., Castro, M.: Preventing memory error exploits with wit. In: IEEE Symposium on Security and Privacy, pp. 263–277. IEEE, Los Alamitos (2008)Google Scholar
  23. 23.
    Bhatkar, S., DuVarney, D.C., Sekar, R.: Address obfuscation: An efficient approach to combat a broad range of memory error exploits. In: Proceedings of 12th USENIX Security Symposium, pp. 105–120. USENIX (2003)Google Scholar
  24. 24.
    Kiriansky, V., Bruening, D., Amarasinghe, S.: Secure execution via program shepherding. In: Proceedings of the 11th USENIX Security Symposium, pp. 191–206. USENIX (2002)Google Scholar
  25. 25.
    Chen, S., Xu, J., Sezer, E.C., Gauriar, P., Iyer, R.K.: Non-control-data attacks are realistic threats. In: Proceedings of the 14th Usenix Security Symposium, pp. 177–192. USENIX (2005)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Jason D. Hiser
    • 1
  • Clark L. Coleman
    • 1
  • Michele Co
    • 1
  • Jack W. Davidson
    • 1
  1. 1.Department of Computer ScienceUniversity of VirginiaVirginiaU.S.A.

Personalised recommendations