Abstract:Affected by vulnerabilities, the control data on the stack is easily destroyed, which provides the most convenient conditions for code reuse attacks (CRAs). The operating system (OS) does not impose strict restrictions on the control flow paths. It allows instructions to jump to any location in the same address space. The OS will prevent code execution if and only if an execution error occurs. However, attackers can use stack overflow to accurately tamper with the control data on the stack and avoid execution errors. Although canary technology has been widely adopted, it turns out that this method can be bypassed. The traditional shadow stack technology can only protect the backward control flow and is invalid for the forward control flow. In contrast, the defense effect of the control flow integrity methods is better. Unfortunately, they either cannot get rid of the source code dependence on the protected objects, or cannot provide high-precision instruction boundaries. All these problems make it difficult to eliminate the CRAs based on stack overflow. Faced with these problems, this paper proposes a new security method KPointer. It filters the vulnerable data by tracking the overwriting operation to the stack data. Next, these data will be tracked to locate the jump instructions related to them. Finally, we use new security strategies to determine whether the current instruction is illegal. Experiments and analysis show that KPointer has a good protection effect on the CRAs based on stack overflow. It does not depend on the source code of the protected objects and only introduces 2.7% performance overhead to the CPU.

Anti-address flooding algorithm for buffer stack overflow

Detecting heap smashing attacks through fault containment wrappers

An Enhancement of Return Address Stack for Security

TableGuard: A Novel Security Mechanism Against Flow Table Overflow Attacks in SDN.

StackGuard+ : Interoperable alternative to canary‐based protection of stack smashing

Defense Buffer Overflow in Code Writing

Buffer Overflow Attacks Analysis and Real-time Detection

Protection of Stack Data Based on LLVM

To Detect Stack Buffer Overflow with Polymorphic Canaries

Research on Principle and Defense of Buffer Overflow Attacks

A New Data Randomization Method to Defend Buffer Overflow Attacks

An Empirical Study on Detecting and Fixing Buffer Overflow Bugs

HeapTherapy: An Efficient End-to-End Solution against Heap Buffer Overflows

A Static Recognition Mechanism For Indirect Call Based On Static Single Assignment

Detection and Defense of SYN Flood Attacks Based on Dual Stack Network Firewall

Analysis of Compiler Technology Enhancement ror Buffer Overflow Prevention

LibsafeXP: A Practical and Transparent Tool for Run-time Buffer Overflow Preventions

KPointer: Keep the code pointers on the stack point to the right code

Progress in Research on Buffer Overflow Vulnerability Analysis Technologies

Research on Detection and Mitigation Methods of Adaptive Flow Table Overflow Attacks in Software-Defined Networks

S3Library: Automatically Eliminating C/C++ Buffer Overflow using Compatible Safer Libraries