Abstract:Reading and writing memory are, besides computation, the most common operations a processor performs. The correctness of these operations is therefore essential for the proper execution of any program. However, as soon as fault attacks are considered, assuming that the hardware performs its memory operations as instructed is not valid anymore. In particular, attackers may induce faults with the goal of reading or writing incorrectly addressed memory, which can have various critical safety and security implications. In this work, we present a solution to this problem and propose a new method for protecting every memory access inside a program against address tampering. The countermeasure comprises two building blocks. First, every pointer inside the program is redundantly encoded using a multi-residue error detection code. The redundancy information is stored in the unused upper bits of the pointer with zero overhead in terms of storage. Second, load and store instructions are extended to link data with the corresponding encoded address from the pointer. Wrong memory accesses subsequently infect the data value allowing the software to detect the error. For evaluation purposes, we implemented our countermeasure into a RISC-V processor, tested it on a FPGA development board, and evaluated the induced overhead. Furthermore, a LLVM-based C compiler has been modified to automatically encode all data pointers, to perform encoded pointer arithmetic, and to emit the extended load/store instructions with linking support. Our evaluations show that the countermeasure induces an average overhead of 10% in terms of code size and 7% regarding runtime, which makes it suitable for practical adoption.

What you can read is what you can't execute

MemCloak

What You See is Not What You Get! Thwarting Just-in-Time ROP with Chameleon

Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack

Different is Good

Breaking and Fixing Destructive Code Read Defenses

Kcpa: Towards Sensitive Pointer Full Life Cycle Authentication for OS Kernels

Blender: Self-randomizing Address Space Layout for Android Apps

MagBox: Keep the risk functions running safely in a magic box

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

LoadLord: Loading on the Fly to Defend Against Code-Reuse Attacks

Physical Unclonable Functions-Based Linear Encryption Against Code Reuse Attacks.

Practical Control Flow Integrity and Randomization for Binary Executables

De-randomizing the Code Segment with Timing Function Attack

Mitigating Code-Reuse Attacks On Cisc Architectures In A Hardware Approach

Using Name Confusion to Enhance Security

HCIC: Hardware-assisted Control-flow Integrity Checking

Taking a Look into Execute-Only Memory

A Technique Preventing Code Reuse Attacks Based on RISC Processor

Defending ROP Attacks Using Basic Block Level Randomization

Pointing in the Right Direction - Securing Memory Accesses in a Faulty World