  Attacks on heap memory, encompassing memory overflow, double and invalid
free, use-after-free (UAF), and various heap spraying techniques are
ever-increasing. Existing entropy-based secure memory allocators provide
statistical defenses against virtually all of these attack vectors. Although
they claim protections against UAF attacks, their designs are not tailored to
detect (failed) attempts. Consequently, to beat this entropy-based protection,
an attacker can simply launch the same attack repeatedly with the potential use
of heap spraying to further improve their chance of success.
  We introduce S2malloc, aiming to enhance UAF-attempt detection without
compromising other security guarantees or introducing significant performance
overhead. To achieve this, we use three innovative constructs in secure
allocator design: free block canaries (FBC) to detect UAF attempts, random
in-block offset (RIO) to stop the attacker from accurately overwriting the
victim object, and random bag layout (RBL) to impede attackers from estimating
the block size based on its address.
  We show that (a) by reserving 25% of the object size for the RIO offset, an
8-byte canary offers a 69% protection rate if the attacker reuses the same
pointer and 96% protection rate if the attacker does not, against UAF
exploitation attempts targeting a 64 bytes object, with equal or higher
security guarantees against all other attacks; and (b) S2malloc is practical,
with only a 2.8% run-time overhead on PARSEC and an 11.5% overhead on SPEC.
Compared to state-of-the-art entropy-based allocators, S2malloc improves
UAF-protection without incurring additional performance overhead. Compared to
UAF-mitigating allocators, S2malloc trades off a minuscule probability of
failed protection for significantly lower overhead.
