CMASan: Custom Memory Allocator-aware Address Sanitizer

Junwha Hong; Wonil Jang; Mijung Kim; Lei Yu; Yonghwi Kwon; Yuseok Jeon

doi:10.1109/SP61157.2025.00074

CMASan: Custom Memory Allocator-aware Address Sanitizer

Junwha Hong
, Wonil Jang
, Mijung Kim
, Lei Yu
, Yonghwi Kwon
, Yuseok Jeon^*

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

2 Citations (Scopus)

Abstract

Custom Memory Allocator (CMA) replaces the standard memory allocator for various purposes, such as improving memory efficiency or enhancing security. However, memory objects allocated by CMA are vulnerable to memory bugs similar to those allocated by the standard memory allocator. Unfortunately, existing memory bug detection approaches, including Address Sanitizer (ASan), do not work properly with these CMAs because existing approaches are mainly designed for the standard memory allocator. This paper presents CMASan, the first CMA-aware address sanitizer designed to effectively detect memory bugs on CMA objects that ASan misses without requiring expert knowledge, manual code modifications, or changing the unique internal logic of CMAs. According to our evaluation, CMASan successfully identifies 19 previously unknown CMA memory bugs undetected by ASan, including some undetected for 9 years. Compared to ASan, CMASan incurs only an additional 9.63% overhead.

Original language	English
Title of host publication	Proceedings - 46th IEEE Symposium on Security and Privacy, SP 2025
Editors	Marina Blanton, William Enck, Cristina Nita-Rotaru
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	740-757
Number of pages	18
ISBN (Electronic)	9798331522360
DOIs	https://doi.org/10.1109/SP61157.2025.00074
Publication status	Published - 2025
Externally published	Yes
Event	46th IEEE Symposium on Security and Privacy, SP 2025 - San Francisco, United States Duration: 2025 May 12 → 2025 May 15

Publication series

Name	Proceedings - IEEE Symposium on Security and Privacy
ISSN (Print)	1081-6011

Conference

Conference	46th IEEE Symposium on Security and Privacy, SP 2025
Country/Territory	United States
City	San Francisco
Period	25/5/12 → 25/5/15

Bibliographical note

Publisher Copyright:
© 2025 IEEE.

ASJC Scopus subject areas

Software
Safety, Risk, Reliability and Quality
Computer Networks and Communications

Access to Document

10.1109/SP61157.2025.00074

Cite this

Hong, J., Jang, W., Kim, M., Yu, L., Kwon, Y., & Jeon, Y. (2025). CMASan: Custom Memory Allocator-aware Address Sanitizer. In M. Blanton, W. Enck, & C. Nita-Rotaru (Eds.), Proceedings - 46th IEEE Symposium on Security and Privacy, SP 2025 (pp. 740-757). (Proceedings - IEEE Symposium on Security and Privacy). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/SP61157.2025.00074

CMASan: Custom Memory Allocator-aware Address Sanitizer. / Hong, Junwha; Jang, Wonil; Kim, Mijung et al.
Proceedings - 46th IEEE Symposium on Security and Privacy, SP 2025. ed. / Marina Blanton; William Enck; Cristina Nita-Rotaru. Institute of Electrical and Electronics Engineers Inc., 2025. p. 740-757 (Proceedings - IEEE Symposium on Security and Privacy).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Hong, J, Jang, W, Kim, M, Yu, L, Kwon, Y & Jeon, Y 2025, CMASan: Custom Memory Allocator-aware Address Sanitizer. in M Blanton, W Enck & C Nita-Rotaru (eds), Proceedings - 46th IEEE Symposium on Security and Privacy, SP 2025. Proceedings - IEEE Symposium on Security and Privacy, Institute of Electrical and Electronics Engineers Inc., pp. 740-757, 46th IEEE Symposium on Security and Privacy, SP 2025, San Francisco, United States, 25/5/12. https://doi.org/10.1109/SP61157.2025.00074

Hong J, Jang W, Kim M, Yu L, Kwon Y, Jeon Y. CMASan: Custom Memory Allocator-aware Address Sanitizer. In Blanton M, Enck W, Nita-Rotaru C, editors, Proceedings - 46th IEEE Symposium on Security and Privacy, SP 2025. Institute of Electrical and Electronics Engineers Inc. 2025. p. 740-757. (Proceedings - IEEE Symposium on Security and Privacy). doi: 10.1109/SP61157.2025.00074

@inproceedings{ba3d3bfbb60a4e87bf44af1b95d5ba00,

title = "CMASan: Custom Memory Allocator-aware Address Sanitizer",

abstract = "Custom Memory Allocator (CMA) replaces the standard memory allocator for various purposes, such as improving memory efficiency or enhancing security. However, memory objects allocated by CMA are vulnerable to memory bugs similar to those allocated by the standard memory allocator. Unfortunately, existing memory bug detection approaches, including Address Sanitizer (ASan), do not work properly with these CMAs because existing approaches are mainly designed for the standard memory allocator. This paper presents CMASan, the first CMA-aware address sanitizer designed to effectively detect memory bugs on CMA objects that ASan misses without requiring expert knowledge, manual code modifications, or changing the unique internal logic of CMAs. According to our evaluation, CMASan successfully identifies 19 previously unknown CMA memory bugs undetected by ASan, including some undetected for 9 years. Compared to ASan, CMASan incurs only an additional 9.63\% overhead.",

author = "Junwha Hong and Wonil Jang and Mijung Kim and Lei Yu and Yonghwi Kwon and Yuseok Jeon",

note = "Publisher Copyright: {\textcopyright} 2025 IEEE.; 46th IEEE Symposium on Security and Privacy, SP 2025 ; Conference date: 12-05-2025 Through 15-05-2025",

year = "2025",

doi = "10.1109/SP61157.2025.00074",

language = "English",

series = "Proceedings - IEEE Symposium on Security and Privacy",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "740--757",

editor = "Marina Blanton and William Enck and Cristina Nita-Rotaru",

booktitle = "Proceedings - 46th IEEE Symposium on Security and Privacy, SP 2025",

}

TY - GEN

T1 - CMASan

T2 - 46th IEEE Symposium on Security and Privacy, SP 2025

AU - Hong, Junwha

AU - Jang, Wonil

AU - Kim, Mijung

AU - Yu, Lei

AU - Kwon, Yonghwi

AU - Jeon, Yuseok

PY - 2025

Y1 - 2025

N2 - Custom Memory Allocator (CMA) replaces the standard memory allocator for various purposes, such as improving memory efficiency or enhancing security. However, memory objects allocated by CMA are vulnerable to memory bugs similar to those allocated by the standard memory allocator. Unfortunately, existing memory bug detection approaches, including Address Sanitizer (ASan), do not work properly with these CMAs because existing approaches are mainly designed for the standard memory allocator. This paper presents CMASan, the first CMA-aware address sanitizer designed to effectively detect memory bugs on CMA objects that ASan misses without requiring expert knowledge, manual code modifications, or changing the unique internal logic of CMAs. According to our evaluation, CMASan successfully identifies 19 previously unknown CMA memory bugs undetected by ASan, including some undetected for 9 years. Compared to ASan, CMASan incurs only an additional 9.63% overhead.

AB - Custom Memory Allocator (CMA) replaces the standard memory allocator for various purposes, such as improving memory efficiency or enhancing security. However, memory objects allocated by CMA are vulnerable to memory bugs similar to those allocated by the standard memory allocator. Unfortunately, existing memory bug detection approaches, including Address Sanitizer (ASan), do not work properly with these CMAs because existing approaches are mainly designed for the standard memory allocator. This paper presents CMASan, the first CMA-aware address sanitizer designed to effectively detect memory bugs on CMA objects that ASan misses without requiring expert knowledge, manual code modifications, or changing the unique internal logic of CMAs. According to our evaluation, CMASan successfully identifies 19 previously unknown CMA memory bugs undetected by ASan, including some undetected for 9 years. Compared to ASan, CMASan incurs only an additional 9.63% overhead.

UR - https://www.scopus.com/pages/publications/105009347771

U2 - 10.1109/SP61157.2025.00074

DO - 10.1109/SP61157.2025.00074

M3 - Conference contribution

AN - SCOPUS:105009347771

T3 - Proceedings - IEEE Symposium on Security and Privacy

SP - 740

EP - 757

BT - Proceedings - 46th IEEE Symposium on Security and Privacy, SP 2025

A2 - Blanton, Marina

A2 - Enck, William

A2 - Nita-Rotaru, Cristina

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 12 May 2025 through 15 May 2025

ER -

CMASan: Custom Memory Allocator-aware Address Sanitizer

Abstract

Publication series

Conference

Bibliographical note

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this