Transparent and Efficient CFI Enforcement with Intel Processor Trace

Liu, Yutao; Shi, Peitao; Wang, Xinran; Chen, Haibo; Zang, Binyu; Guan, Haibing

doi:10.1109/hpca.2017.18

Cited by 68 publications

(32 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…GRIFFIN [51] is an operating system mechanism (running in the kernel) that leverages the PT feature to enforce CFI policies. PT-CFI [52] and FLOWGUARD [53] are two backward-edge control-flow violation detection systems using PT tracing. To address the over-approximation problem of control targets in forward-edge CFI, PITTYPAT [54] utilizes PT to track basic block execution to compute the legal control transfer target sets through runtime path-sensitive point-to analysis.…”

Section: A Tracing Indirect and Conditional Branches With Ptmentioning

confidence: 99%

Exploitation Techniques and Defenses for Data-Oriented Attacks

Cheng

Liljestrand

Ahmed

et al. 2019

2019 IEEE Cybersecurity Development (SecDev)

View full text Add to dashboard Cite

Data-oriented attacks manipulate non-control data to alter a program's benign behavior without violating its controlflow integrity. It has been shown that such attacks can cause significant damage even in the presence of control-flow defense mechanisms. However, these threats have not been adequately addressed. In this SoK paper, we first map data-oriented exploits, including Data-Oriented Programming (DOP) attacks, to their assumptions/requirements and attack capabilities. We also compare known defenses against these attacks, in terms of approach, detection capabilities, overhead, and compatibility. Then, we experimentally assess the feasibility of a detection approach that is based on the Intel Processor Trace (PT) technology. PT only traces control flows, thus, is generally believed to be not useful for data-oriented security. However, our work reveals that data-oriented attacks (in particular the recent DOP attacks) may generate side-effects on control-flow behavior in multiple dimensions, which manifest in PT traces. Based on this evaluation, we discuss challenges for building deployable dataoriented defenses and open research questions.

show abstract

Section: A Tracing Indirect and Conditional Branches With Ptmentioning

confidence: 99%

Exploitation Techniques and Defenses for Data-Oriented Attacks

Cheng

Liljestrand

Ahmed

et al. 2019

2019 IEEE Cybersecurity Development (SecDev)

View full text Add to dashboard Cite

show abstract

“…If anything, shadow stacks are typically stored at well-known memory locations (such as the data segment, within the TLS, or at a fixed offset from the regular stack), enabling an attacker to overwrite the copies of return addresses. Merely some recent hardware-assisted schemes deploy isolated monitoring processes, which inherently protects their shadow stacks from information disclosure, but also induces non-negligible performance overheads [27,34].…”

Section: Related Workmentioning

confidence: 99%

A Leak-Resilient Dual Stack Scheme for Backward-Edge Control-Flow Integrity

Zieris

Horsch

2018

Proceedings of the 2018 on Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Manipulations of return addresses on the stack are the basis for a variety of attacks on programs written in memory unsafe languages. Dual stack schemes for protecting return addresses promise an efficient and effective defense against such attacks. By introducing a second, safe stack to separate return addresses from potentially unsafe stack objects, they prevent attacks that, for example, maliciously modify a return address by overflowing a buffer. However, the security of dual stacks is based on the concealment of the safe stack in memory. Unfortunately, all current dual stack schemes are vulnerable to information disclosure attacks that are able to reveal the safe stack location, and therefore effectively break their promised security properties. In this paper, we present a new, leakresilient dual stack scheme capable of withstanding sophisticated information disclosure attacks. We carefully study previous dual stack schemes and systematically develop a novel design for stack separation that eliminates flaws leading to the disclosure of safe stacks. We show the feasibility and practicality of our approach by presenting a full integration into the LLVM compiler framework with support for the x86-64 and ARM64 architectures. With an average of 2.7% on x86-64 and 0.0% on ARM64, the performance overhead of our implementation is negligible. CCS CONCEPTS• Security and privacy → Software and application security;

show abstract

“…Besides our work, there are two concurrent and independent efforts that leverage Intel PT for CFI enforcement. FlowGuard [32] and PT-CFI [25] both aim to accelerate their trace processing and policy checking by avoiding recon-struction of complete control flows in their fast processing paths. Without the complete control flows, the source addresses of indirect branches are not available, so FlowGuard and PT-CFI cannot enforce fine-grained, forward-edge CFI policies like GRIFFIN.…”

Section: Related Workmentioning

confidence: 99%

Griffin

Cui

Jaeger

2017

SIGPLAN Not.

View full text Add to dashboard Cite

Researchers are actively exploring techniques to enforce control-flow integrity (CFI), which restricts program execution to a predefined set of targets for each indirect control transfer to prevent code-reuse attacks. While hardwareassisted CFI enforcement may have the potential for advantages in performance and flexibility over software instrumentation, current hardware-assisted defenses are either incomplete (i.e., do not enforce all control transfers) or less efficient in comparison. We find that the recent introduction of hardware features to log complete control-flow traces, such as Intel Processor Trace (PT), provides an opportunity to explore how efficient and flexible a hardware-assisted CFI enforcement system may become. While Intel PT was designed to aid in offline debugging and failure diagnosis, we explore its effectiveness for online CFI enforcement over unmodified binaries by designing a parallelized method for enforcing various types of CFI policies. We have implemented a prototype called GRIFFIN in the Linux 4.2 kernel that enables complete CFI enforcement over a variety of software, including the Firefox browser and its jitted code. Our experiments show that GRIFFIN can enforce fine-grained CFI policies with shadow stack as recommended by researchers at a performance that is comparable to software-only instrumentation techniques. In addition, we find that alternative logging approaches yield significant performance improvements for trace processing, identifying opportunities for further hardware assistance. CCS Concepts • Security and privacy → Operating systems security

show abstract

Transparent and Efficient CFI Enforcement with Intel Processor Trace

Cited by 68 publications

References 33 publications

Exploitation Techniques and Defenses for Data-Oriented Attacks

Exploitation Techniques and Defenses for Data-Oriented Attacks

A Leak-Resilient Dual Stack Scheme for Backward-Edge Control-Flow Integrity

Griffin

Contact Info

Product

Resources

About