Abstract:Address space layout randomization (ASLR) is now widely adopted in modern operating systems to thwart code reuse attacks. However, an adversary can still bypass fine-grained ASLR by exploiting memory corruption vulnerabilities and performing memory disclosure attacks. Although Execute-no-Read schemes have been proven to be an efficient solution against read-based memory disclosures, existing solutions need modifications to kernel or hypervisor. Besides, the defense of execution-based memory disclosures has been ignored. In this paper, we propose BoundShield, a self-protection scheme that provides comprehensive protection against memory disclosure attacks, especially against those based on executing arbitrary code by leveraging Intel Memory Protection Extension. BoundShield protects code memory by defending not only read-based memory disclosure attacks but also execution-based memory disclosure attacks. On one hand, read-based memory disclosures can be eliminated by hiding all code sections and code pointers in a secret region separated from the user address space. On the other hand, BoundShield prevents return addresses from being corrupted and ensures that all function pointers point to the legitimate entries whenever they are dereferenced, which significantly reduces the attack surface for execution-based memory disclosures. We have implemented a prototype of BoundShield based on a set of modifications to compiler toolchain and the standard C library. Our evaluation results show that the BoundShield can provide strong defenses against memory disclosure attacks while incurring a small performance overhead.

A Static Recognition Mechanism For Indirect Call Based On Static Single Assignment

Dynamic Stack Buffer-overflow Prevention Based on Return-address Translation

Different is Good

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

Against Code Injection with System Call Randomization

Defending ROP Attacks Using Basic Block Level Randomization

Prevention of Code Reuse Attacks through Return Address Protection

Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack

Lightweight and Seamless Memory Randomization for Mission-Critical Services in a Cloud Platform

Secure the Commodity Applications Against Address Exposure Attacks

Automatic Verification of Embedded System Code Manipulating Dynamic Structures Stored in Contiguous Regions.

The Illusion of Randomness: An Empirical Analysis of Address Space Layout Randomization Implementations

Dynamic Buffer Overflow Prevention Based on K Circular Random Sequence

BoundShield: Comprehensive Mitigation for Memory Disclosure Attacks Via Secret Region Isolation

MagBox: Keep the risk functions running safely in a magic box

Defense Method Against Code Reuse Attack Based on Real-time Code Loading and Unloading

What You See is Not What You Get! Thwarting Just-in-Time ROP with Chameleon

Protection of Stack Data Based on LLVM

JIT-spraying prevention mechanism based on instruction padding randomization

Practical Control Flow Integrity and Randomization for Binary Executables

A Segment-based Approach of Defending Against Buffer Overflow Attacks