Description
Even today, control-flow-based attacks on programs written in memory-unsafe languages
remain a dominant threat [26]. The widely used type-based CFI mechanism
is insufficient to prevent all such attacks [2]. However, stronger security mechanisms
incur high overhead, limiting their practicality [24] [13].
Therefore, we created a tool to apply a multi-level approach. We use a stronger
mechanism [24] only for indirect calls we deem sufficiently hazardous, while we guard
the remaining calls with type-based CFI. To assess the danger of an individual indirect
call, we take into account the number of targets allowed by the CFI policy. Next, we
compare this individual number of targets with a fixed threshold or check whether it is
high enough to be in the top percentiles of all allowed target group sizes. Apart from
that, we vary the specific threshold or percentile we use to measure its performance
effects.
Furthermore, we protect pointers used in calls deemed dangerous enough with a
cryptographic MAC. For all potentially relevant pointers, we compute a MAC when
they are stored and verify only those used in indirect calls that we consider sufficiently
risky.
We examined the effectiveness of our approach by applying it to two open-source
programs and varying the risk-approximation threshold.
Currently, we are not able to significantly reduce the overhead for both programs.
However, in select cases, we may reduce the overhead of the stronger protection scheme
by at most 20%, compared to applying it to all indirect calls.
|
