2nd/10_Wiki/Topics/Frontend/Pointer Poisoning.md

id, title, category, status, canonical_id, aliases, duplicate_of, source_trust_level, confidence_score, verification_status, tags, raw_sources, last_reinforced, github_commit, tech_stack

id	title	category	status	canonical_id	aliases	duplicate_of	source_trust_level	confidence_score	verification_status	tags	raw_sources	last_reinforced	github_commit	tech_stack
wiki-2026-0508-pointer-poisoning	Pointer Poisoning	10_Wiki/Topics	verified	self	Pointer Poisoning Poison Values Memory Poisoning	none	A	0.9	applied	security memory-safety c cpp kernel defensive-programming		2026-05-10	pending	language framework C none

Pointer Poisoning

매 한 줄

"매 freed pointer 의 detectable invalid value 채움". Pointer poisoning 매 use-after-free / double-free / uninitialized-read 의 detection 기법 — free 후 pointer 를 매 0x0, 0xDEADBEEF, kernel-specific magic 으로 set 하여 매 dereference 즉시 crash. Linux kernel LIST_POISON1/2, glibc MALLOC_PERTURB_, AddressSanitizer 매 광범위 활용. 2026 기준 Rust/Swift 매 ownership 으로 매 회피, C/C++ 매 여전히 핵심 defensive technique.

매 핵심

매 왜 poison

• Use-after-free 즉시 detect: 매 0xDEAD... dereference → page fault.
• Debugger trail: stack trace 의 pointer value 만 보고 매 lifecycle stage 추정.
• Heap exploit 완화: attacker 매 freed object reuse 의 일부 차단.

매 일반적인 poison value

• 0x0 — 매 NULL (가장 단순, page 0 unmapped).
• 0xDEADBEEF / 0xDEADC0DE — 매 32-bit human-readable.
• 0xDEADBEEFDEADBEEF — 매 64-bit.
• Linux kernel: LIST_POISON1 = 0xdead000000000100, LIST_POISON2 = 0xdead000000000122 (매 user-space dereference 시 distinct fault address).
• glibc tcache: poison 매 next-pointer 의 obfuscation (safe-linking, 2.32+).

매 응용

1. Linux kernel list_del — LIST_POISON1/2 매 next/prev.
2. glibc MALLOC_PERTURB_ — alloc/free 시 매 byte fill.
3. AddressSanitizer — shadow memory + redzone poison.
4. Embedded firmware — magic pattern 매 stack canary.
5. Safe-linking — heap freelist pointer XOR mask.

💻 패턴

Manual poison after free (C)

#include <stdlib.h>
#include <stdint.h>

#define POISON_PTR ((void *)(uintptr_t)0xDEADBEEFDEADBEEFULL)

void safe_free(void **p) {
    if (!p || !*p) return;
    free(*p);
    *p = POISON_PTR; // dereference → fault, NULL check 도 통과
}

// Usage
void example(void) {
    char *buf = malloc(64);
    safe_free((void **)&buf);
    // *buf = 'x'; // ← SIGSEGV at 0xDEADBEEFDEADBEEF
}

Linux kernel list poison

// include/linux/poison.h
#define LIST_POISON1  ((void *) 0xdead000000000100)
#define LIST_POISON2  ((void *) 0xdead000000000122)

static inline void __list_del_entry(struct list_head *entry) {
    __list_del(entry->prev, entry->next);
    entry->next = LIST_POISON1; // dereference → kernel oops at distinct addr
    entry->prev = LIST_POISON2;
}

Stack canary (poison-ish)

#define CANARY 0xCAFEBABEDEADBEEFULL

void critical_fn(void) {
    volatile uint64_t canary = CANARY;
    char buf[64];
    // ... do work, possibly overflowing buf ...
    if (canary != CANARY) {
        __builtin_trap(); // overflow detected
    }
}

MALLOC_PERTURB_ (glibc env)

# Fill freed memory with 0x42, alloc memory with ~0x42
MALLOC_PERTURB_=66 ./my_program

Safe-linking (glibc 2.32+ tcache pointer obfuscation)

// Conceptual: actual implementation in malloc.c
#define PROTECT_PTR(pos, ptr) \
    ((__typeof(ptr))((((size_t)(pos)) >> 12) ^ ((size_t)(ptr))))
#define REVEAL_PTR(ptr) PROTECT_PTR(&(ptr), ptr)

// Storing freed chunk's next pointer obfuscated → attacker-controlled
// linked-list overwrite no longer trivially redirects allocator.

C++ smart pointer reset (매 modern equivalent)

#include <memory>

void modern() {
    auto p = std::make_unique<Widget>();
    p->use();
    p.reset(); // p == nullptr now; UAF 매 not possible via p
    // p->use(); // SIGSEGV (NULL deref)
}

Sanitizer-driven (no manual poison)

# AddressSanitizer poisons freed memory + redzones automatically
clang -fsanitize=address -g -O1 prog.c -o prog
./prog # use-after-free → ASAN report with stack

매 결정 기준

상황	Approach
Modern C++	smart pointer + reset (no manual poison)
Modern systems	Rust ownership (compile-time prevent)
C kernel / embedded	manual poison (LIST_POISON*, magic)
Debug build	-fsanitize=address
Production heap	safe-linking (glibc 2.32+ default)
Stack overflow detect	canary + -fstack-protector-strong

기본값: 매 new code 매 Rust / smart pointer. C 의 legacy 만 manual poison.

🔗 Graph

🤖 LLM 활용

언제: legacy C/C++ codebase 의 UAF debug, kernel module dev, embedded firmware hardening. 언제 X: managed language (JS/TS/Python/Java) — GC 가 매 처리. 매 over-engineering.

❌ 안티패턴

• Free without poison + raw pointer 재사용: 매 silent UAF — heap reuse 시 detection X.
• Poison value 가 valid mappable address: 매 0x1 매 page 0 의 일부 — distinct unmapped 사용.
• Poison only after free, not in struct invalidation: 매 list, tree node 의 stale pointer 미처리.
• Trust poison without ASLR: 매 attacker 매 정확한 poison value 알아도 OK — poison 매 detection only, not mitigation alone.
• Production with ASAN: 매 2-3x slowdown, memory 2x — 매 staging only.

🧪 검증 / 중복

• Verified (Linux kernel include/linux/poison.h, glibc malloc.c safe-linking, Google AddressSanitizer paper, OWASP Memory Corruption).
• 신뢰도 A.

🕓 Changelog

날짜	변경
2026-05-08	Phase 1
2026-05-10	Manual cleanup — manual poison, LIST_POISON, canary, safe-linking, ASAN 패턴