Control-Flow Integrity

Abstract

Memory corruption errors in C/C++ programs remain the most common source of security vulnerabilities in today’s systems. Control-flow hijacking attacks exploit memory corruption vulnerabilities to divert program execution away from the intended control flow. Researchers have spent more than a decade studying and refining defenses based on Control-Flow Integrity (CFI); this technique is now integrated into several production compilers. However, so far, no study has systematically compared the various proposed CFI mechanisms nor is there any protocol on how to compare such mechanisms. We compare a broad range of CFI mechanisms using a unified nomenclature based on (i) a qualitative discussion of the conceptual security guarantees, (ii) a quantitative security evaluation, and (iii) an empirical evaluation of their performance in the same test environment. For each mechanism, we evaluate (i) protected types of control-flow transfers and (ii) precision of the protection for forward and backward edges. For open-source, compiler-based implementations, we also evaluate (iii) generated equivalence classes and target sets and (iv) runtime performance.

Secure delivery of program properties through optimizing compilation

“…Such protections take many forms, including duplicated execution or tracking the effective flow in auxiliary counters, taint detection variables, trackers, etc. [16]. Compiler optimizations transform the control flow without any knowledge of the implicit link between the protection code and what underlying mechanisms it is meant to track.…”

“…In general, the link between such smart functional encoding and the related assumptions on the execution cannot be made explict, given the semantic abstraction gap between source and machine code. These encodings are also as diverse as the (approximate) models of the machine state and transitions instrumented by control flow integrity countermeasures [16]. We are thus looking for a generic solution rather than property-or optimization-specific ones.…”

Control-Flow Integrity: Attacks and Protections

“…According to Niu et al [44], bin-CFI permits a function to return to every viable return address; hence, the accuracy of this CFI is fragile to Return-Oriented programming (ROP)-based attacks. AIR is not a very suitable metric while considering it from a security perspective [57]. Two main reasons are; First, every CFI mechanism produces similar AIR numbers; hence, making the AIR improper when compared with other CFI mechanisms.…”

“…Statically computed CFG does not produce a proper result, and various experiments prove that DEP is by-passable. PICFI only relies on underlying static analysis and can be affected by label creep by obtaining a vast number of labels from CFG [57].…”

A case against indirect jumps for secure programs

“…CFI has an extensive literature. A recent review has been published by Burow et al [4]. Most CFI solutions try to verify that jumps can only reach legitimate addresses (forward edges).…”