Trail of Bits Blog
Follow
Use GWP-ASan to detect exploits in production environments
GWP-ASan is a sampling-based memory error detection tool designed for production environments, addressing the performance limitations of tools like ASan. It detects critical bugs, such as use-after-free and buffer overflows, with minimal performance impact. GWP-ASan instruments a small fraction of memory allocations, using guard pages around sampled allocations to catch memory access violations. This allows it to identify heap-related bugs with near-zero overhead, balancing detection and performance. The tool is implemented in various projects like Chromium, Firefox, and Android, showcasing its versatility. GWP-ASan's sampling approach makes it suitable for large-scale deployments, with a negligible performance cost even when detecting rare bugs. Programs can be built with GWP-ASan using compilers like Clang and allocators that support it. The tool's behavior is configurable via environment variables like sample rate and the maximum number of simultaneous allocations. GWP-ASan identifies bugs by triggering segmentation faults when programs attempt to access memory within guard pages. Symbolization tools can improve error message readability. The performance overhead is low and can be controlled by configuration parameters, making it viable for production use.
