Abstract:With the improvements of computing technology, more and more applications embed powerful ARM processors into their devices. These systems can be attacked by redirecting the control-flow of a program to bypass critical pieces of code such as privilege checks or signature verifications. Control-flow hijacks can be performed using classical software vulnerabilities, physical fault attacks, or software-induced fault attacks. To cope with this threat and to protect the control-flow, dedicated countermeasures are needed. To counteract control-flow hijacks, control-flow integrity~(CFI) aims to be a generic solution. However, software-based CFI typically either protects against software or fault attacks, but not against both. While hardware-assisted CFI can mitigate both types of attacks, they require extensive hardware modifications. As hardware changes are unrealistic for existing ARM architectures, a wide range of systems remains unprotected and vulnerable to control-flow attacks. In this work, we present FIPAC, an efficient software-based CFI scheme protecting the execution at basic block granularity of ARM-based devices against software and fault attacks. FIPAC exploits ARM pointer authentication of ARMv8.6-A to implement a cryptographically signed control-flow graph. We cryptographically link the correct sequence of executed basic blocks to enforce CFI at this granularity. We use an LLVM-based toolchain to automatically instrument programs. The evaluation on SPEC2017 with different security policies shows a code overhead between 54-97\% and a runtime overhead between 35-105%. While these overheads are higher than for countermeasures against software attacks, FIPAC outperforms related work protecting the control-flow against fault attacks. FIPAC is an efficient solution to provide protection against software- and fault-based CFI attacks on basic block level on modern ARM devices.

MAFIA: Protecting the Microarchitecture of Embedded Systems Against Fault Injection Attacks

Armlock: Hardware-Based Fault Isolation For Arm

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Self-Assertion-Based Countermeasures Within a RISC-V Microprocessor for Coverage of Information Leakage Faults

Electromagnetic fault injection against a System-on-Chip, toward new micro-architectural fault models

FIPAC: Thwarting Fault- and Software-Induced Control-Flow Attacks with ARM Pointer Authentication

Faulting original McEliece's implementations is possible: How to mitigate this risk?

Experimental evaluation of two software countermeasures against fault attacks

A Micro Architectural Events Aware Real-Time Embedded System Fault Injector

EC-CFI: Control-Flow Integrity via Code Encryption Counteracting Fault Attacks

Node Monitoring as a Fault Detection Countermeasure against Information Leakage within a RISC-V Microprocessor

ACFA: Secure Runtime Auditing & Guaranteed Device Healing via Active Control Flow Attestation

ARMORY: Fully Automated and Exhaustive Fault Simulation on ARM-M Binaries

Oops..! I Glitched It Again! How to Multi-Glitch the Glitching-Protections on ARM TrustZone-M

Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller

Bypassing Isolated Execution on RISC-V using Side-Channel-Assisted Fault-Injection and Its Countermeasure

Model Checking for Microarchitectural Data Sampling Security

CFI CaRE: Hardware-supported Call and Return Enforcement for Commercial Microcontrollers

SCFI: State Machine Control-Flow Hardening Against Fault Attacks

Combining static analysis and dynamic symbolic execution in a toolchain to detect fault injection vulnerabilities

Prevention of Microarchitectural Covert Channels on an Open-Source 64-bit RISC-V Core