Efficient Return Address Verification Based on Dislocated Stack
| Autor: | Li Jinfeng, Chen Liwei, Shi Gang, Yongyue Li, Dan Meng, Xu Qizhen |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
business.industry
Call stack Computer science Code reuse 02 engineering and technology Computer Graphics and Computer-Aided Design 020202 computer hardware & architecture Control flow Stack (abstract data type) Embedded system 0202 electrical engineering electronic engineering information engineering Overhead (computing) Message authentication code Electronic design automation Electrical and Electronic Engineering business Software |
| Zdroj: | IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems. 39:3398-3407 |
| ISSN: | 1937-4151 0278-0070 |
| Popis: | Return-oriented programming (ROP) is a prevalent code reuse technique that hijacks a program’s control flow by modifying its return addresses on the stack. Researchers have proposed some return address verification methods by using the message authentication code (MAC). But these approaches suffer from high performance overhead. In this article, we first propose Dislocated Stack, a new kind of stack layout in which a previous return address would be pushed onto the current stack frame and the current return address would be stored into a hardware buffer on function calls. Based on Dislocated Stack, we design two new verification approaches, Lazy Verification and Batch Verification. Lazy Verification does not verify a return address popped from stack until it is going to be used for return. Batch Verification verifies a couple of return addresses at one time. We implemented these two designs on RISC-V architecture and quantitatively analyzed their effect on QEMU. Our experiments show that Lazy Verification reduces over 99% verifications on function returns and incurs only 1.23% performance overhead; while in Batch Verification, the overhead is merely 0.78%. The result demonstrates that these two approaches are highly efficient for return address verification. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|