Systems code is often written in low-level languages like C/C++, which offer many benefits but also delegate memory management to programmers. This invites memory safety bugs that attackers can exploit to divert control flow and compromise the system. Deployed defense mechanisms (e.g., ASLR, DEP) are incomplete, and stronger defense mechanisms (e.g., CFI) often have high overhead and limited guarantees [19, 15, 9].We introduce code-pointer integrity (CPI), a new design point that guarantees the integrity of all code pointers in a program (e.g., function pointers, saved return addresses) and thereby prevents all control-flow hijack attacks, including return-oriented programming. We also introduce code-pointer separation (CPS), a relaxation of CPI with better performance properties. CPI and CPS offer substantially better security-to-overhead ratios than the state of the art, they are practical (we protect a complete FreeBSD system and over 100 packages like apache and postgresql), effective (prevent all attacks in the RIPE benchmark), and efficient: on SPEC CPU2006, CPS averages 1.2% overhead for C and 1.9% for C/C++, while CPI's overhead is 2.9% for C and 8.4% for C/C++.A prototype implementation of CPI and CPS can be obtained from http://levee.epfl.ch.

/pdf/code-pointer-integrity-2gu5mwg209.pdf

Code-pointer integrity

As control-flow hijacking defenses gain adoption, it is important to understand the remaining capabilities of adversaries via memory exploits. Non-control data exploits are used to mount information leakage attacks or privilege escalation attacks program memory. Compared to control-flow hijacking attacks, such non-control data exploits have limited expressiveness, however, the question is: what is the real expressive power of non-control data attacks? In this paper we show that such attacks are Turing-complete. We present a systematic technique called data-oriented programming (DOP) to construct expressive non-control data exploits for arbitrary x86 programs. In the experimental evaluation using 9 programs, we identified 7518 data-oriented x86 gadgets and 5052 gadget dispatchers, which are the building blocks for DOP. 8 out of 9 real-world programs have gadgets to simulate arbitrary computations and 2 of them are confirmed to be able to build Turing-complete attacks. We build 3 end-to-end attacks to bypass randomization defenses without leaking addresses, to run a network bot which takes commands from the attacker, and to alter the memory permissions. All the attacks work in the presence of ASLR and DEP, demonstrating how the expressiveness offered by DOP significantly empowers the attacker.

/pdf/data-oriented-programming-on-the-expressiveness-of-non-4eeypw4wzw.pdf

Data-Oriented Programming: On the Expressiveness of Non-control Data Attacks

Control-Flow Integrity.

Code-reuse attacks such as return-oriented programming (ROP) pose a severe threat to modern software. Designing practical and effective defenses against code-reuse attacks is highly challenging. One line of defense builds upon fine-grained code diversification to prevent the adversary from constructing a reliable code-reuse attack. However, all solutions proposed so far are either vulnerable to memory disclosure or are impractical for deployment on commodity systems. In this paper, we address the deficiencies of existing solutions and present the first practical, fine-grained code randomization defense, called Read actor, resilient to both static and dynamic ROP attacks. We distinguish between direct memory disclosure, where the attacker reads code pages, and indirect memory disclosure, where attackers use code pointers on data pages to infer the code layout without reading code pages. Unlike previous work, Read actor resists both types of memory disclosure. Moreover, our technique protects both statically and dynamically generated code. We use a new compiler-based code generation paradigm that uses hardware features provided by modern CPUs to enable execute-only memory and hide code pointers from leakage to the adversary. Finally, our extensive evaluation shows that our approach is practical -- we protect the entire Google Chromium browser and its V8 JIT compiler -- and efficient with an average SPEC CPU2006 performance overhead of only 6.4%.

/pdf/readactor-practical-code-randomization-resilient-to-memory-2clv859jfc.pdf

Readactor: Practical Code Randomization Resilient to Memory Disclosure

Control flow integrity (CFI) has been proposed as an approach to defend against control-hijacking memory corruption attacks. CFI works by assigning tags to indirect branch targets statically and checking them at runtime. Coarse-grained enforcements of CFI that use a small number of tags to improve the performance overhead have been shown to be ineffective. As a result, a number of recent efforts have focused on fine-grained enforcement of CFI as it was originally proposed. In this work, we show that even a fine-grained form of CFI with unlimited number of tags and a shadow stack (to check calls and returns) is ineffective in protecting against malicious attacks. We show that many popular code bases such as Apache and Nginx use coding practices that create flexibility in their intended control flow graph (CFG) even when a strong static analyzer is used to construct the CFG. These flexibilities allow an attacker to gain control of the execution while strictly adhering to a fine-grained CFI. We then construct two proof-of-concept exploits that attack an unlimited tag CFI system with a shadow stack. We also evaluate the difficulties of generating a precise CFG using scalable static analysis for real-world applications. Finally, we perform an analysis on a number of popular applications that highlights the availability of such attacks.

/pdf/control-jujutsu-on-the-weaknesses-of-fine-grained-control-hw7egppnyr.pdf

Control Jujutsu: On the Weaknesses of Fine-Grained Control Flow Integrity

Memory corruption attacks continue to be a major vector of attack for compromising modern systems Numerous defenses have been proposed against memory corruption attacks, but they all have their limitations and weaknesses Stronger defenses such as complete memory safety for legacy languages (C/C++) incur a large overhead, while weaker ones such as practical control flow integrity have been shown to be ineffective A recent technique called code pointer integrity (CPI) promises to balance security and performance by focusing memory safety on code pointers thus preventing most control-hijacking attacks while maintaining low overhead CPI protects access to code pointers by storing them in a safe region that is protected by instruction level isolation On x86-32, this isolation is enforced by hardware, on x86-64 and ARM, isolation is enforced by information hiding We show that, for architectures that do not support segmentation in which CPI relies on information hiding, CPI's safe region can be leaked and then maliciously modified by using data pointer overwrites We implement a proof-of-concept exploit against Nginx and successfully bypass CPI implementations that rely on information hiding in 6 seconds with 13 observed crashes We also present an attack that generates no crashes and is able to bypass CPI in 98 hours Our attack demonstrates the importance of adequately protecting secrets in security mechanisms and the dangers of relying on difficulty of guessing without guaranteeing the absence of memory leaks

/pdf/missing-the-point-er-on-the-effectiveness-of-code-pointer-4c9ess93nf.pdf

Missing the Point(er): On the Effectiveness of Code Pointer Integrity

Memory corruption attacks continue to be a major
vector of attack for compromising modern systems. Strong defenses
such as complete memory safety for legacy languages (C/C++) incur a
large overhead, while weaker and practical defenses such as Code
Pointer Integrity (CPI) and Control Flow Integrity (CFI) have their
weaknesses. In this thesis, we present attacks that expose the
fundamental weaknesses of CPI and CFI. CPI promises to balance
security and performance by focusing memory safety on code pointers
thus preventing most control-hijacking attacks while maintaining
low overhead. CPI protects access to code pointers by storing them
in a safe region that is isolated by hardward enforcement on
0x86-32 architecture and by information-hiding on 0x86-64 and ARM
architectures. We show that when CPI relies on information hiding,
it's safe region can be leaked and thus rendering it ineffective
against malicious exploits. CFI works by assigning tags to indirect
branch targets statically and checking them at runtime.
Coarse-grained enforcements of CFI that use a small number of tags
to improve the performance overhead have been shown to be
ineffective. As a result, a number of recent efforts have focused
on fine-grained enforcement of CFI as it was originally proposed.
In this work, we show that even a fine-grained form of CFI with
unlimited number of tags is ineffective in protecting against
attacks. We show that many popular code bases such as Apache and
Nginx use coding practices that create flexibility in their
intended control flow graph (CFG) even when a strong static
analyzer is used to construct the CFG. These flexibilities allow an
attacker to gain control of the execution while strictly adhering
to a fine-grained CFI.

/pdf/evaluating-modern-defenses-against-control-flow-hijacking-2gj5iz6oec.pdf

Ulziibayar Otgonbaatar

Papers

Control Jujutsu: On the Weaknesses of Fine-Grained Control Flow Integrity

Missing the Point(er): On the Effectiveness of Code Pointer Integrity

Evaluating modern defenses against control flow hijacking