FIPAC: Thwarting Fault- and Software-Induced Control-Flow Attacks with ARM Pointer Authentication

Abstract

With the improvements of computing technology, more and more applications in the Internet-of-Things, mobile devices, automotive, or industrial areas embed powerful ARM processors into their devices. These systems can be attacked by redirecting the control-flow of a program to bypass critical pieces of code such as privilege checks or signature verifications or to perform other fault attacks on applications, operating systems, or security mechanisms like secure boot. Control-flow hijacks can be performed using classical software vulnerabilities, physical fault attacks, or software-induced fault attacks, such as CLKscrew or Plundervolt. To cope with this threat and to protect the control-flow, dedicated countermeasures are needed. To counteract control-flow hijacks, control-flow integrity (CFI) aims to be a generic solution. However, software-based CFI protection schemes typically either protect against software or fault attacks, but not against both. While hardware-assisted CFI schemes can mitigate both types of attacks, they require extensive hardware modifications. As hardware changes are unrealistic for existing ARM architectures, a wide range of systems remains unprotected and vulnerable to control-flow attacks. In this work, we present FIPAC, an efficient software-based CFI scheme protecting the execution at basic block granularity of upcoming ARM-based devices against software and fault attacks. FIPAC exploits ARM pointer authentication of recent ARMv8.6-A architectures to implement a cryptographically signed control-flow graph. We cryptographically link the correct sequence of executed basic blocks to enforce control-flow integrity at this granularity at runtime. We use a custom LLVM-based toolchain to automatically instrument programs without user interaction. The evaluation on the application-grade SPEC2017 benchmark with different security policies shows a code size overhead between 54-97 % and a runtime overhead between 35-105 %. For small embedded benchmarks, we measured a runtime overhead between 61-211 %. While these overheads are significantly higher than for countermeasures against software attacks, FIPAC outperforms related work protecting the control-flow against fault attacks. FIPAC is an efficient solution to provide protection against softwareand fault-based CFI attacks on basic block level on modern ARM devices.