Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack

Ping Chen,Jun Xu,Jun Wang,Peng Liu

DOI: https://doi.org/10.48550/arXiv.1507.02786

2015-07-10

Abstract:Fine-grained Address Space Randomization has been considered as an effective protection against code reuse attacks such as ROP/JOP. However, it only employs a one-time randomization, and such a limitation has been exploited by recent just-in-time ROP and side channel ROP, which collect gadgets on-the-fly and dynamically compile them for malicious purposes. To defeat these advanced code reuse attacks, we propose a new defense principle: instantly obsoleting the address-code associations. We have initialized this principle with a novel technique called virtual space page table remapping and implemented the technique in a system CHAMELEON. CHAMELEON periodically re-randomizes the locations of code pages on-the-fly. A set of techniques are proposed to achieve our goal, including iterative instrumentation that instruments a to-be-protected binary program to generate a re-randomization compatible binary, runtime virtual page shuffling, and function reordering and instruction rearranging optimizations. We have tested CHAMELEON with over a hundred binary programs. Our experiments show that CHAMELEON can defeat all of our tested exploits by both preventing the exploit from gathering sufficient gadgets, and blocking the gadgets execution. Regarding the interval of our re-randomization, it is a parameter and can be set as short as 100ms, 10ms or 1ms. The experiment results show that CHAMELEON introduces on average 11.1%, 12.1% and 12.9% performance overhead for these parameters, respectively.

Cryptography and Security

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the bypassing of existing fine - grained address space randomization (ASR) techniques by advanced code - reuse attacks (such as ROP/JOP attacks). Specifically, traditional ASR techniques are randomized only once at load time, which enables "one - shot - two - kills" ROP attacks based on memory leakage or side - channel attacks to dynamically collect and compile gadgets, thereby bypassing existing ASR defense mechanisms. Therefore, these attacks can successfully exploit vulnerabilities in programs to execute malicious logic.

To meet this challenge, the author proposes a new defense principle - instantly obsoleting the address - code associations. The core idea of this principle is to periodically re - randomize the location of code pages at runtime, so that the address - code associations identified by attackers during the construction of malicious payloads become obsolete before actual execution. In this way, even if attackers can obtain address - code associations by certain means, these associations will become invalid due to frequent randomization, thereby preventing the successful implementation of the attack.

The author further develops a system named CHAMELEON to implement this new defense principle. CHAMELEON periodically re - randomizes the location of code pages through virtual address page table remapping (VAPTR) technology, and ensures the normal operation of the system and minimizes performance overhead through a series of technical means (such as iterative instrumentation, runtime virtual page shuffling, function re - ordering, and instruction rearrangement optimization, etc.). Experimental results show that CHAMELEON can effectively defend against various "one - shot - two - kills" ROP attacks with relatively low performance overhead.