Perspective Security Beyond Memory Safety Using Modern C++ to Avoid Vulnerabilities by DesignMax Hoffmann Security Beyond Memory Safety CppCon 2024 2 Security Beyond Memory Safety Using Modern C++ to Security Beyond Memory Safety CppCon 2024 3 FIFTY SHADES OF SHOOTING YOURSELF IN THE FOOT WITH A RAILGUNMax Hoffmann Security Beyond Memory Safety CppCon 2024 4Max Hoffmann Security Beyond Memory Safety CppCon Security Beyond Memory Safety CppCon 2024 6Max Hoffmann Security Beyond Memory Safety CppCon 2024 7Max Hoffmann Security Beyond Memory Safety CppCon 2024 8Max Hoffmann Security Beyond Memory Safety CppCon

A Relaxed Guide to memory_order_relaxed Hans Boehm Paul E. McKenney Google Facebook CPPCON 2020std::atomic/std::atomic_ref and memory_order_relaxed ● C++ atomic sacrificing the simple threads-as-interleaving semantics ● by passing memory_order enum values to explicit atomic operations. ● In particular, memory_order_relaxed allows arbitrary visibility reordering with respect About memory_order_relaxed? ● Just a load, just a store: Full control, excellent efficiency and scalability! ○ Assuming aligned machine-sized atomic objects, that is…What is Not to Like About memory_order_relaxed

© 2019 Apex.AI, Inc. Safe and certified software for autonomous mobility TM Practical memory pool based allocators for Modern C++ by Misha Shalem misha.shalem@apex.ai © 2020 Apex.AI, Inc.● CppCon Andreas Pasternak ● Quote: “Memory pools and allocators are only one piece of the solution” Today we going to talk about this one piece in (more) depth © 2020 Apex.AI, Inc.Memory allocations in real-time practically for C++ memory allocations? We asked an independent 3rd party safety assessor and the answer was “It should comply to Autosar C++ 14 Coding Guidelines regarding memory allocations” © 2020

Bar std::string Bar std::string Bar std::stringObject Introspection (OI) Goals • Byte level memory footprint analysis for objects • Complete object type hierarchies • Dynamic allocations and containers hierarchy from a given root type • Understand the layout in memory of the entire hierarchy • Understand how to interpret data at memory offsets • Understand containers • Compiler generated debug Object Introspection Measurement Code Code GenerationApplied Example 1 • Unused container memory: Unused Sz = (C.capacity() - C.size()) * sizeof(element) Name TypeName Number ElemStatSz Length

Memory Model C++11 – C++23About Me: alex.dathskovsky@speedata.io www.linkedin.com/in/alexdathskovsky https://www.cppnext.comAlex Dathskovsky | alex.dathskovsky@speedata.io | www.linkedin.com/in/a hazards • an instruction can be executed when its operands have been calculated or loaded from memory • an instruction stalls if operands are not availableAlex Dathskovsky | alex.dathskovsky@speedata com/in/alexdathskovsky Reordering Types • Data dependencies must be honored • C++ compiler may reorder any memory access under the as-if rule • Different processors have different reordering guarantiesAlex

reader.Read(); // Blocks! thread xfutures/promises: “buffered channel” Channel channel; Channel::Reader reader = channel.Reader(); reader.Read(); // Blocks! Channel::Writer Channel channel; Channel::Reader reader = channel.Reader(); reader.Read(); // Blocks! Channel::Writer writer = channel.Writer(); writer.Write("..."); // Non-blocking! Channel channel; Channel::Reader reader = channel.Reader(); reader.Read(); // Blocks! Channel::Writer writer = channel.Writer(); writer.Write("..."); // Non-blocking! writer

AnalyticsA story 🚨 90% Memory Used: What’s that alarm? 🔍Back to basics: How does my code impact memory usage? 👷 Memory allocation troubleshooting & tools: Leak & Fragmentation🚨 90% Memory Used: What’s that that alarm?🚨 90% Memory Used What’s that alarm? Consequences: ● Swap: performance degradation ● Out-of-memory (OOM) killer: service disruption ● Multi-tenant environment: resources are shared by different processes🚨 90% Memory Used ~$ top -o RES What’s that alarm?🚨 90% Memory Used What’s that alarm? ~$ top -o RES🔍Back to basics: How does my code impact memory usage?How does my code impact memory usage?

modern C++ also gives us the convenient std::function. Functions need not always be 'global' building blocks of our programs, the next step in our journey will be to see how we can have functions at local oftentimes in handy ways in the STL). Ah, intrigued are you? We're not quite done! Now with building blocks such as lambda's (and related functors) we can utilize function composition to really unlock the functions are helping achieve code reuse, slightly different abstractions, but both serving as building blocks to implement algorithms.Example Bitmap Functions ● All of these functions are related to operating

Limited Storage & Memory 7 < 1 MB = 33,725 devices >= 1 MB = 4,964 devicesMicrocontroller Constraints: Limited Storage & Memory 8 < 100kB = 31,098 devices >= 100kB = 7095With so little memory how do you you prevent running out of memory or memory fragmentation? 9Typical Best Practice: Do not/avoid dynamic allocations malloc realloc new free delete calloc 10Typical Best Practice: Do not/avoid C++ meetingTIME SPACE So why do firmware developers avoid C++ exceptions? 14 Requires Dynamic Memory/Heap Increases Binary Size Requires whole C++ STL Run Time Type Info (RTTI) Exception Tables

gave us a “memory model” ● Now a program consists of one or more threads of execution ● Every write to a single memory location must synchronize-with all other reads or writes of that memory location (Pushing back t is delivering the letter.)condition_variable for “wait until” Here is the code that blocks and waits, using std::condition_variable cv_. Token getToken() { std::unique_lock lk(mtx_); can queue up on lock. ● Calling unlock unblocks exactly one waiter: the new “owner.” ● lock blocks only if somebody “owns” the mutex. Comparison of C++11’s primitives once_flag: ● Many threads