Abstract:Low-level languages like C/C++ are widely used in various applications for their performance and flexibility. Unfortunately, these languages are prone to memory corruption vulnerabilities, leading to control-flow hijacking attacks. Control flow integrity (CFI) is a general principle to enforce run-time control flow of a program to a pre-computed control-flow graph (CFG). While the traditional context-insensitive CFI falls short in protecting critical control transfers, recent context-sensitive CFI research shows promising improvements but has various limitations. We present Control Flow Integrity with Look Back (CFI-LB), a call-site sensitive CFI in which a conventional source-target control transfer is strengthened by a look back into its call-sites (return addresses). CFI-LB features the adaptive call-site sensitivity in which each indirect call has its own level of sensitivity and the multi-scope CFG to improve the security even if a precise context-sensitive static CFG is not available, especially for large programs such as GCC and NGINX. One of the CFGs is constructed by our localized concolic execution, which significantly extends the dynamic CFG with very low false positives. In addition, CFI-LB is the first CFI system explicitly designed to protect its reference monitors from race conditions. We have built a prototype of CFI-LB. The evaluation with SPEC CPU2006 benchmarks and NGINX indicates that CFI-LB has a low-performance overhead (less than 5% on average for the full protection) while increasing the security.

HCDFG-Ⅱ-A Representation of Control/Data Flow Graph for C Language System Specification

HCDFG-II Model Generation from System Specification in C

A Hierarchical CDFG As Intermediate Representation for Hardware/software Codesign

Constraint Function Based Hierarchical Control of Discrete Event Systems

Extension of the Hierarchical CDFG for the High-Level SOC System Design

A New Computing Model for C-Like Hardware Description Languages

Adaptive Call-Site Sensitive Control Flow Integrity

Hierarchical Control and Data Flow Graph Modeling Method in Energy-aware Hardware/Software Partitioning

Extended-DDF Modeling Embedded System Design: Adapting to IP Technology

Automatic enhanced CDFG generation based on runtime instrumentation

Source-code-level Transformation and APT-Driven Parallelism Pre-processes for Embedded System Automated Design

Analyzing Data Flow Diagrams by Combination of Formal Methods and Visualization Techniques.

HW/SW Co-Design for Embedded System Based on DDF

Architecture of Software System Based on Hierarchy

Sub-graph Matching Based HW/SW Co-Design

Hierarchical states in the Compositional Interchange Format

Graph Transformations On Cdfg For Granularity Selection In Hardware-Software Partitioning

FORMAL SPECIFICATION AND MANAGEMENT OF MULTI-LAYERED CONFIGURATION FILE IN DYNAMIC DISTRIBUTED SYSTEMS

Behavioral Description in Visual Vhdl and It'S Implementation

FDE2009 Software System for Programmable Logic Device with Hierarchical Architecture

A Heterogeneous Dependency Graph As Intermediate Representation for Instruction Set Customization