Compiler Optimizations Can Remove Security Protections in C Code

Compiler Optimizations and Security Risks

Security researcher Chris Domas, in a discussion at Black Hat, explained how C code written with security best practices can still result in vulnerable binaries. This is due to legal compiler optimizations that can remove security protections, eliminate memory-clearing operations, and introduce time-of-check to time-of-use vulnerabilities. The core issue is that the CPU executes the compiler's output, not the original source code.

Factors Influencing Vulnerability

Domas detailed how the C abstract machine allows compilers significant freedom in code transformation. Factors such as register pressure, structure layout, and even data size can influence whether a binary becomes vulnerable. He provided an example where specific data sizes (17 or 33 bytes) were safe, while nearby sizes produced vulnerable code.

Addressing the Problem

The discussion also touched upon whether languages like Rust mitigate these issues and why simply switching between compilers like GCC and Clang is not a complete solution. AI played a role in analyzing 500 million lines of open-source code, identifying 300 potentially dangerous patterns related to these compiler behaviors.

Developer Recommendations

Domas provided actionable advice for developers to mitigate these risks. Recommendations include enabling compiler warnings, utilizing sanitizers, analyzing optimized builds, and rigorously testing the exact binary that will be deployed to ensure its security posture.