Note
The paper is available here.
This repository contains the artifact for the USENIX Security '26 paper: "DMGuard: Safeguarding Kernels from Physical-Page Use-After-Free Vulnerabilities"
DMGuard is a runtime solution that detects and prevents physical-page use-after-free vulnerabilities across diverse translation domains (CPU, GPU, and IOMMU page tables).
This artifact includes the following components:
- Linux kernel v6.6 and Mali GPU Driver r52p0 patches implementing DMGuard
- Five real CVE PoCs and five synthetic PoCs
- Automated scripts for security and performance evaluation
- A QEMU ARM64 evaluation environment based on Docker
Note: This artifact reproduces a representative subset of the paper's evaluations. Some tests requiring specific hardware or kernel versions are excluded (see E1 for details). Since the performance evaluation runs on QEMU emulation, absolute numbers may differ from those reported in the paper.
- Required: x86_64 host machine
- Minimum: 8GB RAM, 100GB free disk space
- Recommended: 16GB RAM, 8+ CPU cores (for faster kernel builds)
- No special hardware required (QEMU-based emulation)
- Linux with Docker Engine and Docker Compose installed
- All other dependencies are included in the Docker image
# Step 1: Register binfmt (run once on host)
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
# Step 2: Clone and build
git clone https://github.com/compsec-snu/dmguard
cd dmguard-open
docker compose build # ~10 minutes
# Step 3: Start container
docker compose up -d
docker compose exec dmguard-ae bash
# Step 4: Build kernels and VM image (inside container, ~120 minutes)
./ae/scripts/setup-all.sh
# Step 5: Run basic test
./ae/scripts/basic-test.sh
# Step 6: Run evaluations
./ae/scripts/run-security-eval.sh # E1: ~20 minutes
./ae/scripts/run-performance-eval.sh # E2: ~120 minutes(C1): DMGuard can comprehensively detect physical-page use-after-free vulnerabilities.
(C2): DMGuard exhibits acceptable runtime overhead, though relatively
higher than ptcheck.
Time: ~20 compute-minutes
./ae/scripts/run-security-eval.shResults are saved to results/security/table2_security.txt.
============================================================
DMGuard Security Evaluation Report
============================================================
Table 2: Security evaluation results
Vulnerability Page Ctx Map Ctx PTCHECK DMGuard
---------------------------- ---------- ---------- ------------ ------------
CVE-2024-1065 CPU CPU Detected Detected
CVE-2022-36449 CPU CPU Detected Detected
CVE-2025-0072 GPU CPU Vulnerable Detected
CVE-2022-33917 GPU CPU Vulnerable Detected
CVE-2024-0671 GPU GPU Vulnerable Detected
Synthetic Map-after-free CPU GPU Vulnerable Detected
Synthetic Map-after-free CPU CPU Vulnerable Detected
Synthetic Map-after-free GPU GPU Vulnerable Detected
Synthetic Map-after-free GPU CPU Vulnerable Detected
Synthetic Free-before-unmap CPU CPU Vulnerable Detected
Legend:
Page Ctx - Allocator that produced the page (CPU: buddy allocator, GPU: GPU page allocator)
Map Ctx - Page table where the mapping resides (CPU/GPU/IOMMU)
Vulnerable - Vulnerability triggered, system in exploitable state
Detected - Vulnerability detected and blocked
C1 is confirmed if:
- DMGuard detects all 10 reproducible vulnerabilities
ptcheckdetects only 2 vulnerabilities (CVE-2024-1065 and CVE-2022-36449)
Note on excluded CVEs: The paper's Table 2 contains 15 vulnerabilities. This artifact reproduces 10 of them (5 real CVEs and 5 synthetic PoCs). The remaining 5 CVEs are excluded:
- CVE-2023-6241, CVE-2023-33107: Require real Mali/Adreno GPU hardware (not available in QEMU emulation)
- CVE-2024-0582, CVE-2024-47674, CVE-2024-53096: Affect kernel versions other than v6.6.0 used in this artifact
Time: ~120 compute-minutes
./ae/scripts/run-performance-eval.shResults are saved to three files:
results/performance/table4_lmbench.txtresults/performance/table7_boot_time.txtresults/performance/table9_memory.txt
Table 7: Boot Time
============================================
Table 7: Boot time (median of 11 runs)
============================================
Baseline (s) ptcheck (s) DMGuard (s)
Median 0.699 0.716 (+2.43%) 0.744 (+6.44%)
============================================
Table 9: Memory Overhead
============================================
Table 9: Memory overhead
============================================
Baseline (KB) ptcheck (KB) DMGuard (KB)
MemTotal 4014116 4014120 4013860
MemFree 3959680 3951448 3943120
------------------------------------------------------------
Overhead — +0.21% +0.41%
============================================
Table 4: LMBench Latency
============================================
Table 4: LMBench latency (median of 11 runs)
============================================
Test Baseline ptcheck DMGuard
(us) (us / overhead) (us / overhead)
--------------------------------------------------------------------------------------------
Simple syscall 11.8248 12.0387 (+1.81%) 11.8330 (+0.07%)
Simple read 14.6578 14.9440 (+1.95%) 15.0809 (+2.89%)
Simple write 14.0835 14.1675 (+0.60%) 14.2030 (+0.85%)
Simple fstat 17.0000 16.9561 (-0.26%) 17.1944 (+1.14%)
Simple open/close 71.1282 70.6923 (-0.61%) 75.7957 (+6.56%)
Select on 100 fd's 23.3771 23.2809 (-0.41%) 27.5739 (+17.95%)
Signal handler installation 12.9408 13.2530 (+2.41%) 12.8719 (-0.53%)
Signal handler overhead 40.8247 41.7660 (+2.31%) 42.5761 (+4.29%)
Protection fault 15.5319 16.5027 (+6.25%) 16.0000 (+3.01%)
Process fork+exit 2266.3333 2497.3333 (+10.19%) 2828.5000 (+24.81%)
Process fork+execve 2649.6667 2965.0000 (+11.90%) 3404.0000 (+28.47%)
Process fork+/bin/sh -c 28553.0000 29242.0000 (+2.41%) 30413.0000 (+6.51%)
--------------------------------------------------------------------------------------------
Geomean overhead — +3.14% +7.60%
============================================
C2 is confirmed if DMGuard overhead is observed to be approximately 2-3x
that of ptcheck.
Note: Since this artifact runs in a QEMU emulation environment, absolute numbers will be higher than those measured on actual Pixel 8 hardware as reported in the paper. Nevertheless, the overhead remains acceptable and similar trends are maintained.
- GitHub: https://github.com/compsec-snu/dmguard
- Zenodo DOI: https://doi.org/10.5281/zenodo.17970502