Missing the Point(er): On the Effectiveness of Code Pointer Integrity
Memory corruption attacks continue to be a major vector of attack for compromising modern systems. Numerous defenses have been proposed against memory corruption attacks, but they all have their limitations and weaknesses. Stronger defenses such as complete memory safety for legacy languages (C/C++)...
| Main Authors: | , , , , , , , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | English |
| Published: |
Institute of Electrical and Electronics Engineers (IEEE)
2020
|
| Online Access: | https://hdl.handle.net/1721.1/125963 |
| _version_ | 1826193441359396864 |
|---|---|
| author | Evans, Isaac Fingeret, Samuel (Samuel P.) González, Julián Armando Otgonbaatar, Ulziibayar Tang, Tiffany(Tiffany L.) Shrobe, Howard E Sidiroglou, Stylianos Rinard, Martin C Okhravi, Hamed |
| author2 | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory |
| author_facet | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Evans, Isaac Fingeret, Samuel (Samuel P.) González, Julián Armando Otgonbaatar, Ulziibayar Tang, Tiffany(Tiffany L.) Shrobe, Howard E Sidiroglou, Stylianos Rinard, Martin C Okhravi, Hamed |
| author_sort | Evans, Isaac |
| collection | MIT |
| description | Memory corruption attacks continue to be a major vector of attack for compromising modern systems. Numerous defenses have been proposed against memory corruption attacks, but they all have their limitations and weaknesses. Stronger defenses such as complete memory safety for legacy languages (C/C++) incur a large overhead, while weaker ones such as practical control flow integrity have been shown to be ineffective. A recent technique called code pointer integrity (CPI) promises to balance security and performance by focusing memory safety on code pointers thus preventing most control-hijacking attacks while maintaining low overhead. CPI protects access to code pointers by storing them in a safe region that is protected by instruction level isolation. On x86-32, this isolation is enforced by hardware, on x86-64 and ARM, isolation is enforced by information hiding. We show that, for architectures that do not support segmentation in which CPI relies on information hiding, CPI's safe region can be leaked and then maliciously modified by using data pointer overwrites. We implement a proof-of-concept exploit against Nginx and successfully bypass CPI implementations that rely on information hiding in 6 seconds with 13 observed crashes. We also present an attack that generates no crashes and is able to bypass CPI in 98 hours. Our attack demonstrates the importance of adequately protecting secrets in security mechanisms and the dangers of relying on difficulty of guessing without guaranteeing the absence of memory leaks. |
| first_indexed | 2024-09-23T09:39:17Z |
| format | Article |
| id | mit-1721.1/125963 |
| institution | Massachusetts Institute of Technology |
| language | English |
| last_indexed | 2024-09-23T09:39:17Z |
| publishDate | 2020 |
| publisher | Institute of Electrical and Electronics Engineers (IEEE) |
| record_format | dspace |
| spelling | mit-1721.1/1259632022-09-26T12:52:55Z Missing the Point(er): On the Effectiveness of Code Pointer Integrity Evans, Isaac Fingeret, Samuel (Samuel P.) González, Julián Armando Otgonbaatar, Ulziibayar Tang, Tiffany(Tiffany L.) Shrobe, Howard E Sidiroglou, Stylianos Rinard, Martin C Okhravi, Hamed Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Lincoln Laboratory Memory corruption attacks continue to be a major vector of attack for compromising modern systems. Numerous defenses have been proposed against memory corruption attacks, but they all have their limitations and weaknesses. Stronger defenses such as complete memory safety for legacy languages (C/C++) incur a large overhead, while weaker ones such as practical control flow integrity have been shown to be ineffective. A recent technique called code pointer integrity (CPI) promises to balance security and performance by focusing memory safety on code pointers thus preventing most control-hijacking attacks while maintaining low overhead. CPI protects access to code pointers by storing them in a safe region that is protected by instruction level isolation. On x86-32, this isolation is enforced by hardware, on x86-64 and ARM, isolation is enforced by information hiding. We show that, for architectures that do not support segmentation in which CPI relies on information hiding, CPI's safe region can be leaked and then maliciously modified by using data pointer overwrites. We implement a proof-of-concept exploit against Nginx and successfully bypass CPI implementations that rely on information hiding in 6 seconds with 13 observed crashes. We also present an attack that generates no crashes and is able to bypass CPI in 98 hours. Our attack demonstrates the importance of adequately protecting secrets in security mechanisms and the dangers of relying on difficulty of guessing without guaranteeing the absence of memory leaks. Office of Naval Research (award N00014-14-1-0006) DARPA (Grant FA8650-11-C-7192) 2020-06-23T20:54:45Z 2020-06-23T20:54:45Z 2015-07 2019-07-02T16:06:01Z Article http://purl.org/eprint/type/ConferencePaper 978-1-4673-6949-7 1081-6011 2375-1207 https://hdl.handle.net/1721.1/125963 Evans, Isaac, et al. "Missing the Point(er): On the Effectiveness of Code Pointer Integrity." 2015 IEEE Symposium on Security and Privacy, San Jose, CA, 2015, pp. 781-796, doi: 10.1109/SP.2015.53. © 2015 Author(s) en 10.1109/SP.2015.53 IEEE Symposium on Security and Privacy Creative Commons Attribution-Noncommercial-Share Alike http://creativecommons.org/licenses/by-nc-sa/4.0/ application/pdf Institute of Electrical and Electronics Engineers (IEEE) MIT web domain |
| spellingShingle | Evans, Isaac Fingeret, Samuel (Samuel P.) González, Julián Armando Otgonbaatar, Ulziibayar Tang, Tiffany(Tiffany L.) Shrobe, Howard E Sidiroglou, Stylianos Rinard, Martin C Okhravi, Hamed Missing the Point(er): On the Effectiveness of Code Pointer Integrity |
| title | Missing the Point(er): On the Effectiveness of Code Pointer Integrity |
| title_full | Missing the Point(er): On the Effectiveness of Code Pointer Integrity |
| title_fullStr | Missing the Point(er): On the Effectiveness of Code Pointer Integrity |
| title_full_unstemmed | Missing the Point(er): On the Effectiveness of Code Pointer Integrity |
| title_short | Missing the Point(er): On the Effectiveness of Code Pointer Integrity |
| title_sort | missing the point er on the effectiveness of code pointer integrity |
| url | https://hdl.handle.net/1721.1/125963 |
| work_keys_str_mv | AT evansisaac missingthepointerontheeffectivenessofcodepointerintegrity AT fingeretsamuelsamuelp missingthepointerontheeffectivenessofcodepointerintegrity AT gonzalezjulianarmando missingthepointerontheeffectivenessofcodepointerintegrity AT otgonbaatarulziibayar missingthepointerontheeffectivenessofcodepointerintegrity AT tangtiffanytiffanyl missingthepointerontheeffectivenessofcodepointerintegrity AT shrobehowarde missingthepointerontheeffectivenessofcodepointerintegrity AT sidirogloustylianos missingthepointerontheeffectivenessofcodepointerintegrity AT rinardmartinc missingthepointerontheeffectivenessofcodepointerintegrity AT okhravihamed missingthepointerontheeffectivenessofcodepointerintegrity |