OPUS: online patches and updates for security

Abstract

We present OPUS, a tool for dynamic software patching capable of applying fixes to a C program at runtime. OPUS’s primary goal is to enable application of security patches to interactive applications that are a frequent target of security exploits. By restricting the type of patches admitted by our system, we are able to significantly reduce any additional burden on the programmer beyond what would normally be required in developing and testing a conventional stop-and-restart patch. We hand-tested 26 real CERT [1] vulnerabilities, of which 22 were dynamically patched with our current OPUS prototype, doing so with negligible runtime overhead and no prior knowledge of the tool’s existence on the patch programmer’s part. 1