Comparative Analysis and Enhancement of CFG-based Hardware-Assisted CFI Schemes

Abstract

Subverting the flow of instructions (e.g., by use of code-reuse attacks) still poses a serious threat to the security of today’s systems. Various control flow integrity (CFI) schemes have been proposed as a powerful technique to detect and mitigate such attacks. In recent years, many hardware-assisted implementations of CFI enforcement based on control flow graphs (CFGs) have been presented by academia. Such approaches check whether control flow transfers follow the intended CFG by limiting the valid target addresses. However, these papers all target different platforms and were evaluated with different sets of benchmark applications, which makes quantitative comparisons hardly possible. For this paper, we have implemented multiple promising CFG-based CFI schemes on a common platform comprising a RISC-V within FPGA. By porting almost 40 benchmark applications to this system we can present a meaningful comparison of the various techniques in terms of run-time performance, hardware utilization, and binary size. In addition, we present an enhanced CFI approach that is inspired by what we consider the best concepts and ideas of previously proposed mechanisms. We have made this approach more practical and feature-complete by tackling some problems largely ignored previously. We show with this fine-grained scheme that CFI can be achieved with even less overheads than previously demonstrated.

Memory Integrity Techniques for Memory-Unsafe Languages: A Survey

“…Intel CET: Control-Flow Enforcement Technology (CET) is a security feature developed by Intel [70] to enhance protection against exploits that target the control flow of running programs, such as Return-Oriented Programming (ROP) and Jump-Oriented Programming (JOP). CET introduces two primary security mechanisms that can be individually enabled for different privilege levels [71] [72].…”

CFIEE: An Open-Source Critical Metadata Extraction Tool for RISC-V Hardware-Based CFI Schemes

“…During this phase, the CFI mechanism continuously monitors the control flow transfers within the running program [26]. By continuously monitoring these control flow transfers, the CFI mechanism aims to verify whether they adhere to the predetermined Control Flow Graph (CFG) constructed in the first phase [27]. The CFG serves as a blueprint for legitimate control flow paths within the program.…”