Oscar: A Practical Page-Permissions-Based Scheme...
summary
Oscar implements a page-permissions, virtual-alias scheme that enforces heap temporal safety and runs with no source code required. The system uses per-object alias pages, a high-watermark allocator to avoid reusing freed virtual addresses, fork-aware copy-on-write fixes and syscall batching via remap to cut overhead. On SPEC workloads Oscar shows as low as ~3.7% runtime overhead (typical SPEC cases) and compares favorably to competitors (examples: 16% vs 49% runtime in one suite, memory overheads ~32–62% vs up to 90–140%), and the implementation is evaluated end-to-end and works on real programs.
AI-written summary · about
chapters (7)
- 0:00Introduction to memory safety
- 1:21Design goals for protection
- 2:08Overview of previous defenses
- 6:27Page-based security schemes
- 11:06The Oscar protection scheme
- 15:23Empirical evaluation
- 19:44Conclusion and Q&A
related talks
15mOsprey: Transparent and Efficient Virtual Memory for Secure Computation
21mOP-TEE: Shared memory between TAs
15mTAILCHECK: A Lightweight Heap Overflow Detection Mechanism with Page Protection and...
15mORC: Increasing Cloud Memory Density via Object Reuse with Capabilities
21mWhen Oblivious is Not: Attacks against OPAM
27mMitigating speculative execution attacks with ASI - follow up
34mXOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot
22mPrivbox: Faster System Calls Through Sandboxed Privileged Execution