編譯器主導，型態為基礎的返回位址查驗以貫徹控制流完整性

Compiler-Directed Type-Based Return Sanity Check For Control Flow Integrity Enforcement

王本奕(Pen-Yi Wang)

指導教授 ： 徐慰中

國立臺灣大學/電機資訊學院/資訊工程學研究所/碩士(2020年)

https://doi.org/10.6342/NTU202002705

摘要

在控制流劫持攻擊中，返回位址是最常被攻擊的目標，但是Stack Canary與位址隨機化等現行的保護機制已不足以抵抗進階的攻擊手法。Shadow Stack雖然被視為最直接且有效防禦返回位址的方法，然而，軟體實作的Shadow Stack並不實際。
在這篇論文中，我們提出了以型態為基礎的返回位址的查驗方法並實作編譯器中，我們採用控制流完整性的方法，在編譯時期，收集Return-Site跟Return-Target的型態資訊，用以決定哪些Return-Target是合法的，並在每個返回指令前插入返回位址的檢查，確保程式執行時的Return-Site跟Return-Target的型態是一致的。
我們使用真實的漏洞來測試，證明確實可以阻擋攻擊，每個合法的Return-Target集合也足夠的小。SPEC 2006 CPU Benchmark平均須增加8%的執行時間負擔，Nginx平均須增加8%的效能負擔。

關鍵字

軟體安全 ； 軟體防禦機制 ； 編譯器 ； 控制流完整性 ； 控制流劫持攻擊

並列摘要

Overwriting the return address is the most common method in control flow hijacking attacks. Although many defenses against return address hijacking have been proposed, these defenses are quickly becoming ineffective due to new ways to bypass them. Shadow stack is often perceived as an effective way to protect return addresses. However, software implementation of shadow stack is considered impractical, and hardware enforced shadow stack is not available yet.
In this thesis, we have investigated a type-based return address sanity check approach to protect against return address hijacking. This type-based sanity check is implemented in the LLVM compiler. We intend to use the return address sanity check to enforce Control Flow Integrity (CFI). At compile time, we collect type information of Return-Site and Return-Target and insert CFI enforcement checks before the return instructions. At runtime, CFI enforcement checks would ensure the types of Return-Site and Return-Target are consistent.
We have used CVEs to test our prototype and show that our approach can effectively defend the vulnerabilities. We have adopted SPEC 2006 and real-world applications (including Nginx, Pure-FTPd and wget) as our benchmarks. The preliminary results show that our tool incurs 8% performance overhead on average for SPEC 2006, and 0.5% decrease in throughput for the three real world applications.

並列關鍵字

Software Security ； Software Mitigation ； Compiler ； Control Flow Integrity ； Control Flow Hijacking

參考文獻

[1] Crispin Cowan, Calton Pu, Dave Maier, Jonathon Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, Qian Zhang, and Heather Hinton. StackGuard: automatic adaptive detection and prevention of buffer-overflow attacks. In Proceedings of the 7th USENIX Security Symposium, January 1998.

[2] PaX Team, “Address space layout randomization,” Phrack, March, 2003.

[3] Marco-Gisbert, H.; Ripoll, I. Return-to-csu: A new method to bypass 64-bit Linux ASLR. In Proceedings of the Black Hat Asia 2018, Singapore, 20–23 March 2018.

[4] L. Davi, A.-R. Sadeghi, and M. Winandy. ROPdefender: A detection tool to defend against return-oriented programming attacks. Technical Report HGI-TR-2010-001, Ruhr-University Bochum, Mar. 2010.

[5] T. H. Dang, P. Maniatis, and D. Wagner. The performance cost of shadow stacks and stack canaries. In ASIACCS, 2015.