CFIXX: Object Type Integrity for C++

Burow, Nathan; McKee, Derrick; Carr, Scott A.; Payer, Mathias

doi:10.14722/ndss.2018.23279

Cited by 26 publications

(30 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The Intel ISA extension Memory Protection Extension (MPX) provides a hardware mechanism that can be used to implement segmentation [42] in a flexible manner. MPX provides a bounds checking mechanism, with four new 128 bit registers to store the bounds, and two new primitives to perform the upper and lower bounds checks.…”

Section: B Code Centric Solutionsmentioning

confidence: 99%

“…Safe stacks have significant compatibility problems, particularly with unprotected code and without full program analysis the conservative analysis ends up allocating a large number of unsafe stack frames, resulting in unnecessary overhead. CFIXX [42] provides object type integrity by protecting the virtual table pointers of C++ objects, thereby precisely protecting virtual dispatch.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

SoK: Shining Light on Shadow Stacks

Burow¹,

Zhang²,

Payer³

2019

2019 IEEE Symposium on Security and Privacy (SP)

Self Cite

107

View full text Add to dashboard Cite

Control-Flow Hijacking attacks are the dominant attack vector against C/C++ programs. Control-Flow Integrity (CFI) solutions mitigate these attacks on the forward edge, i.e., indirect calls through function pointers and virtual calls. Protecting the backward edge is left to stack canaries, which are easily bypassed through information leaks. Shadow Stacks are a fully precise mechanism for protecting backwards edges, and should be deployed with CFI mitigations.We present a comprehensive analysis of all possible shadow stack mechanisms along three axes: performance, compatibility, and security. For performance comparisons we use SPEC CPU2006, while security and compatibility are qualitatively analyzed. Based on our study, we renew calls for a shadow stack design that leverages a dedicated register, resulting in low performance overhead, and minimal memory overhead, but sacrifices compatibility. We present case studies of our implementation of such a design, Shadesmar, on Phoronix and Apache to demonstrate the feasibility of dedicating a general purpose register to a security monitor on modern architectures, and Shadesmar's deployability. Our comprehensive analysis, including detailed case studies for our novel design, allows compiler designers and practitioners to select the correct shadow stack design for different usage scenarios.Shadow stacks belong to the class of defense mechanisms that require metadata about the program's state to enforce their defense policies. Protecting this metadata for deployed mitigations requires in-process isolation of a segment of the virtual address space. Prior work on defenses in this class has relied on information hiding to protect metadata. We show that stronger guarantees are possible by repurposing two new Intel x86 extensions for memory protection (MPX), and page table control (MPK). Building on our isolation efforts with MPX and MPK, we present the design requirements for a dedicated hardware mechanism to support intra-process memory isolation, and discuss how such a mechanism can empower the next wave of highly precise software security mitigations that rely on partially isolated information in a process.

show abstract

Section: B Code Centric Solutionsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

SoK: Shining Light on Shadow Stacks

Burow¹,

Zhang²,

Payer³

2019

2019 IEEE Symposium on Security and Privacy (SP)

Self Cite

107

View full text Add to dashboard Cite

show abstract

“…The second are attacks targeting the virtual table pointer such as COOP style attacks [78]. These however are an orthogonal problem to stack safety and may be protected through, e.g., OTI [79].…”

Section: Appendix B Miscellaneousmentioning

confidence: 99%

$\mu$RAI: Securing Embedded Systems with Return Address Integrity

Almakhdhub

Clements

Bagchi

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

Self Cite

View full text Add to dashboard Cite

Embedded systems are deployed in security critical environments and have become a prominent target for remote attacks. Microcontroller-based systems (MCUS) are particularly vulnerable due to a combination of limited resources and low level programming which leads to bugs. Since MCUS are often a part of larger systems, vulnerabilities may jeopardize not just the security of the device itself but that of other systems as well. For example, exploiting a WiFi System on Chip (SoC) allows an attacker to hijack the smart phone's application processor. Control-flow hijacking targeting the backward edge (e.g., Return-Oriented Programming-ROP) remains a threat for MCUS. Current defenses are either susceptible to ROP-style attacks or require special hardware such as a Trusted Execution Environment (TEE) that is not commonly available on MCUS. We present µRAI 1 , a compiler-based mitigation to prevent control-flow hijacking attacks targeting backward edges by enforcing the Return Address Integrity (RAI) property on MCUS. µRAI does not require any additional hardware such as TEE, making it applicable to the wide majority of MCUS. To achieve this, µRAI introduces a technique that moves return addresses from writable memory, to readable and executable memory. It repurposes a single general purpose register that is never spilled, and uses it to resolve the correct return location. We evaluate against the different control-flow hijacking attacks scenarios targeting return addresses (e.g., arbitrary write), and demonstrate how µRAI prevents them all. Moreover, our evaluation shows that µRAI enforces its protection with negligible overhead.

show abstract

“…Data flow integrity is another technique which prevents invalid read and writes operation by calculating a valid data flow graph at compile time. Object Type Integrity (Burow et al 2018) is Fig. 17 The second method of initializing arrays designed to protect the programs written in C++ as an orthogonal policy as CFI.…”

Section: Exploit Mitigationsmentioning

confidence: 99%

Memory access integrity: detecting fine-grained memory access errors in binary code

et al. 2019

Cybersecur

View full text Add to dashboard Cite

As one of the most notorious programming errors, memory access errors still hurt modern software security. Particularly, they are hidden deeply in important software systems written in memory unsafe languages like C/C++. Plenty of work have been proposed to detect bugs leading to memory access errors. However, all existing works lack the ability to handle two challenges. First, they are not able to tackle fine-grained memory access errors, e.g., data overflow inside one data structure. These errors are usually overlooked for a long time since they happen inside one memory block and do not lead to program crash. Second, most existing works rely on source code or debugging information to recover memory boundary information, so they cannot be directly applied to detection of memory access errors in binary code. However, searching memory access errors in binary code is a very common scenario in software vulnerability detection and exploitation.In order to overcome these challenges, we propose Memory Access Integrity (MAI), a dynamic method to detect finegrained memory access errors in off-the-shelf binary executables. The core idea is to recover fine-grained accessing policy between memory access behaviors and memory ranges, and then detect memory access errors based on the policy. The key insight in our work is that memory accessing patterns reveal information for recovering the boundary of memory objects and the accessing policy. Based on these recovered information, our method maintains a new memory model to simulate the life cycle of memory objects and report errors when any accessing policy is violated. We evaluate our tool on popular CTF datasets and real world softwares. Compared with the state of the art detection tool, the evaluation result demonstrates that our tool can detect fine-grained memory access errors effectively and efficiently. As the practical impact, our tool has detected three 0-day memory access errors in an audio decoder.

show abstract

CFIXX: Object Type Integrity for C++

Cited by 26 publications

References 21 publications

SoK: Shining Light on Shadow Stacks

SoK: Shining Light on Shadow Stacks

$\mu$RAI: Securing Embedded Systems with Return Address Integrity

Memory access integrity: detecting fine-grained memory access errors in binary code

Contact Info

Product

Resources

About