CYBERSECURITY Research group at UPV

Dynamic memory allocators are a recurrent source of exploitable bugs, and hardening them usually comes at a high performance cost.
We have designed an allocator for multi-thread systems that is secure and fast at the same time, granted as patent US 11886332 B2 (USPTO, January 2024). A paper describing the design is in preparation.

ASLR-NG: Get the maximum protection for your applications

ASLR is a widely used and very effective mitigation technique against most memory error bugs. The effectiveness of the ASLR relies on keeping secret the memory layout of the target process. Therefore, the more randomness, the more secure is the process.
We have designed and implemented (beta) a new ASLR design, which maximizes the entropy and does not jeopardizes the fragmentation.

RenewSSP: Improve the Security of your Servers

Is a new technique to augment the effectiveness of the stack smashing protection mechanism which:

Eliminates brute force attacks against the canary (SSP).
When combined with the ASLR, it has a multiplicative effect.
The overhead is negligible, and zero cost during the execution of the application.
No need to modify the applications (binary or source).
It can be used by just pre-loading a tiny library.

Accepted CVEs

CVE	Product	Description	Vulnerability/Weakness	CVSS
CVE	Product	Description	Vulnerability/Weakness	v2.0	v3.0
CVE-2016-4484	Cryptsetup(Initrd)	Incorrect error handling	Not failing securely	7.2	6.8
CVE-2016-3672	Linux kernel	Disable ASLR	ASLR Weakness	4.6	7.8
CVE-2015-8370	GRUB2	Integer overflow	IX Jornadas STIC CCN-CERT	6.9
CVE-2015-1593	Linux Kernel	Integer overflow	Reduced randomised range	5.0
CVE-2015-1574	Email Android	Denial of Service	Incorrect headers handling	5.0
CVE-2013-6825	DCMTK	Root privilege escalation	Drop privileges failed	7.2
CVE-2013-4788	Glibc	Weak pointer protection	Improper Input Validation	5.1
CVE-2013-6876	s3dvt	Root shell (I)	Drop privileges failed	N.A.
CVE-2014-1226	s3dvt	Root shell (II)	Drop privileges failed	N.A.
CVE-2014-5439	sniffit	Root shell	Stack buffer overflow	N.A.
. . .	. . .	. . .	. . .	. . .

Other Security Issues

Product	Description	Vulnerability/Weakness
Linux kernel	Reduced mmap entropy	Improper mask manipulation
Glibc	Bypass pointer guard	Improper Input Validation
Linux Kernel	AMD Bulldozer ASLR	Reduced randomization
Bash	Root shell	Drop privileges failed
Bash	Crash	Improper input handling
Network printer	Credentials compromised	To be disclosed
Android	Infoleak	To be disclosed

Background

Dynamic memory

Virtualisation

Real-Time systems

• RTLinux (historical)

Teaching

Máster MUCC

• Pentesting y Hacking Ético

Máster MUICR

• Ciberseguridad y Hacking Ético

Grado en Ingeniería Informática

• Hacking Ético

Student satisfaction: average >9, since 2013. (range: 0..10)

Featured Theses

PhD Thesis

Antonio Villalón Huerta (2023)
Modeling of Advanced Threat Actors: characterization, categorization and detection
Cum laude · UPV Extraordinary Doctoral Award 2025

Master Thesis

Óscar Roselló Ibáñez (2026)
Análisis y explotación de vulnerabilidades críticas en el módulo KSMBD de Linux
Grade: Excellent

Selected Publications

"return-to-csu: A New Method to Bypass 64-bit Linux ASLR", (Black Hat Asia, 2018) [URL]

"Exploiting Linux and PaX ASLR's Weaknesses on 32-bit and 64-bit Systems", (Black Hat Asia, 2016) [URL]

"Abusing LUKS to Hack the System", (DeepSec, 2016) [URL]

"Address Space Layout Randomization Next Generation", (Applied Sciences, 2019) [URL]

"SSPFA: effective stack smashing protection for Android OS", (International Journal of Information Security, 2019) [DOI]

"Sptmalloc: A Secure and Fast Dynamic Memory Allocator for Multi-Thread Systems", (in preparation, 2026) [to appear]

more . . .

	Contact us		Home
	Contact us		Home