Kugler, Christopher and Müller, Tilo (2015) Separated Control and Data Stacks to Mitigate Buffer Overflow Exploits. EAI Endorsed Transactions on Security and Safety, 2 (4). e3. ISSN 2032-9393
|
Text
eai.5-10-2015.150477.pdf Available under License Creative Commons Attribution No Derivatives. Download (1MB) | Preview |
Abstract
Despite the fact that protection mechanisms like StackGuard, ASLR and NX are widespread, the development on new defense strategies against stack-based buffer overflows has not yet come to an end. In this article, we present a novel compiler-level protection called SCADS: Separated Control and Data Stacks that protects return addresses and saved frame pointers on a separate stack, called the control stack. In common computer programs, a single user mode stack is used to store control information next to data buffers. By separating control information from the data stack, we can protect sensitive pointers of a program’s control flow from being overwritten by buffer overflows. To substantiate the practicability of our approach, we provide SCADS as an open source patch for the LLVM compiler infrastructure. Focusing on Linux and FreeBSD running on the AMD64 architecture, we show compatibility, security and performance results. As we make control flow information simply unreachable for buffer overflows, many exploits are stopped at an early stage of progression with only negligible performance overhead.
| Item Type: | Article |
|---|---|
| Uncontrolled Keywords: | Stack-based Buffer Overflows, LLVM, Separate Control Stack |
| Subjects: | H Social Sciences > H Social Sciences (General) Q Science > QA Mathematics > QA75 Electronic computers. Computer science QA75 Electronic computers. Computer science |
| Depositing User: | EAI Editor IV |
| Date Deposited: | 26 Mar 2021 13:50 |
| Last Modified: | 26 Mar 2021 13:50 |
| URI: | https://eprints.eudl.eu/id/eprint/2031 |
Actions (login required)
 |
View Item |
CORE (COnnecting REpositories)
CORE (COnnecting REpositories)
