efficient cfi enforcement for c dynamic dispatch
play

Efficient CFI Enforcement for C++ Dynamic Dispatch Dimitar Bounov , - PowerPoint PPT Presentation

Feb 13, 2023 •383 likes •922 views

Efficient CFI Enforcement for C++ Dynamic Dispatch Dimitar Bounov , Rami Kici, Sorin Lerner UCSD Why A:ack Dynamic Dispatch? Valuable targets (e.g. browsers) 11M LOC ~30M LOC 7M LOC ?M LOC C/C++ C/C++ C/C++ C/C++ Why A:ack Dynamic

  1. Efficient CFI Enforcement for C++ Dynamic Dispatch Dimitar Bounov , Rami Kici, Sorin Lerner UCSD

  2. Why A:ack Dynamic Dispatch? • Valuable targets (e.g. browsers) 11M LOC ~30M LOC 7M LOC ?M LOC C/C++ C/C++ C/C++ C/C++

  3. Why A:ack Dynamic Dispatch? • Valuable targets (e.g. browsers) • Prevalence of Dynamic Dispatch • 91.8 % of Indirect Calls in Chrome [ Tice ’14 ]

  4. Why A:ack Dynamic Dispatch? • Valuable targets (e.g. browsers) • Prevalence of Dynamic Dispatch • Exploited in the wild

  5. Prior Work and ContribuAon • Prior defenses vfGuard [Prakash’15], VTInt [Zhao’15], SafeDispatch [Jang’14], VTV [Tice’14] ... • Our contribu^on: novel VTable layouts • Lower overhead & no profiling

  6. Example class A { A Afoo() virtual void foo(); } class B : public A { Bfoo() Afoo() B C virtual void foo(); Bbar() Cbaz() virtual void bar(); } class C : public A { D Dfoo() virtual void baz(); Bbar() } Dboo() class D : public B { virtual void foo(); virtual void boo(); }

  7. C++ Memory Layout A Afoo() Bfoo() Afoo() B C Bbar() Cbaz() D Dfoo() Bbar() Dboo()

  8. C++ Memory Layout Object Instance Virtual Table C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo

  9. Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) A* a = (A*) … fn_ptr = (*(vptr + 0)) a->foo() (*fn_ptr)(); Method Index

  10. ExploiAng Dynamic Dispatch exec C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  11. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  12. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) assert (vptr ∈ { A, B, C, D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  13. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo Read-Only vptr = (*a) assert (vptr ∈ { A, B, C, D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Inline Constant

  14. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) assert (vptr ∈ { A, B, C, D }) How to implement safety fn_ptr = (*(vptr + 0)) check efficiently? (*fn_ptr)();

  15. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) Non-regular values assert (vptr ∈ { 0x0, 0x8, 0x18, 0x28 }) fn_ptr = (*(vptr + 0)) Hard to test (*fn_ptr)();

  16. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Key idea 1: Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz Order and Pad VTables … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) Non-regular values assert (vptr ∈ { 0x0, 0x8, 0x18, 0x28 }) fn_ptr = (*(vptr + 0)) Hard to test (*fn_ptr)();

  17. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo Cbaz 1. Traverse in pre-order: A, B, D, C 2. For each class layout vtable and pad

  18. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz 1. Traverse in pre-order: A, B, D, C assert (vptr ∈ { A,B,C,D }) fn_ptr = (*(vptr + 0)) 2. For each class layout vtable and pad (*fn_ptr)();

  19. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz assert (vptr ∈ { A,B,C,D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  20. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz assert (vptr ∈ { 0x0, 0x20, 0x40, 0x60 }) Regular fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Address Points

  21. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz assert (vptr ∈ { 0x0, 0x20, 0x40, 0x60 }) fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Efficient Check

  22. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz assert (0x0 ≤ vptr ≤ 0x60 ∧ vptr % 0x20 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Efficient Check

  23. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*b) Cbaz assert (vptr ∈ { B, D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  24. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*b) Cbaz assert (vptr ∈ { 0x20, 0x40 }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  25. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*b) Cbaz assert (0x20 ≤ vptr ≤ 0x40 ∧ vptr % 0x20 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  26. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo Cbaz Wasteful Extra Padding

  27. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Key idea 2: Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo Interleave VTables … … Bbar D Dfoo() Dboo Bbar() 16 B Dboo() Afoo Cbaz Wasteful Extra Padding

  28. Interleaved Memory Layout C A A Afoo() … … Bfoo() Afoo() B C Bbar() Cbaz() B D … … D Dfoo() Bbar() Dboo() 1. Traverse in pre-order: A, B, D, C 2. Layout each method

  29. Interleaved Memory Layout C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz 1. Traverse in pre-order: A, B, D, C 2. Layout each method

  30. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*a) 1. Traverse in pre-order: A, B, D, C assert (vptr ∈ { A,B,C,D }) fn_ptr = (*(vptr + 0)) 2. Layout each method (*fn_ptr)();

  31. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*a) assert (vptr ∈ { A,B,C,D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  32. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*a) assert (vptr ∈ { 0x0, 0x8, 0x10, 0x18 }) Address Points fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Consecu^ve Addrs.

  33. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*a) assert (0x0 ≤ vptr ≤ 0x18 ∧ vptr % 0x8 = 0) fn_ptr = (*(vptr + 0)) Same Check (*fn_ptr)(); Different range & alignment

  34. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*b) assert (0x0 ≤ vptr ≤ 0x18 ∧ vptr % 0x8 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  35. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*b) assert (0x8 ≤ vptr ≤ 0x10 ∧ vptr % 0x8 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  36. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*b) assert (0x8 ≤ vptr ≤ 0x10 ∧ vptr % 0x8 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

Recommend

CSE 341 Programming Languages Dynamic Dispatch vs. Closures OOP vs. Functional Decomposition

CSE 341 Programming Languages Dynamic Dispatch vs. Closures OOP vs. Functional Decomposition

CSE 341 Programming Languages Dynamic Dispatch vs. Closures OOP vs. Functional Decomposition Wrapping Up Zach Tatlock Spring 2014 Dynamic dispatch Dynamic dispatch Also known as late binding or virtual methods Call self.m2() in method

935 views • 55 slides
Redundancy-free Residual Dispatch Using Ordered Binary Decision Diagrams for Efficient Dispatch

Redundancy-free Residual Dispatch Using Ordered Binary Decision Diagrams for Efficient Dispatch

Formula-based Dispatch BDD-based Dispatch Assessment Redundancy-free Residual Dispatch Using Ordered Binary Decision Diagrams for Efficient Dispatch Andreas Sewe Christoph Bockisch Mira Mezini Seventh International Workshop on Foundations

408 views • 39 slides
ENFORCEMENT TRAFFIC DIVISION Direct Line : (619) 522-2446 Dispatch (Non-Emergency) : (619)

ENFORCEMENT TRAFFIC DIVISION Direct Line : (619) 522-2446 Dispatch (Non-Emergency) : (619)

MOTORCYCLE ENFORCEMENT TRAFFIC DIVISION Direct Line : (619) 522-2446 Dispatch (Non-Emergency) : (619) 522-7350 Sergeant Shawn ONeill 700 Orange Avenue, Coronado CA 92118 1 The Coronado Police Department Traffic Unit Our goal is to

546 views • 11 slides
Context Threading: A flexible and efficient dispatch technique for virtual machine interpreters

Context Threading: A flexible and efficient dispatch technique for virtual machine interpreters

Context Threading: A flexible and efficient dispatch technique for virtual machine interpreters Marc Berndl Benjamin Vitale Mathew Zaleski Angela Demke Brown Research supported by IBM CAS, NSERC, CITO 1 Interpreter performance Why not

912 views • 25 slides
Objectives Inheritance Polymorphism Dynamic dispatch Sep 11, 2020 Sprenkle - CSCI209 1

Objectives Inheritance Polymorphism Dynamic dispatch Sep 11, 2020 Sprenkle - CSCI209 1

10/7/20 Objectives Inheritance Polymorphism Dynamic dispatch Sep 11, 2020 Sprenkle - CSCI209 1 1 Review We would like to return a private variable from a public method Why could that be a problem? How should we implement

225 views • 21 slides
There's More Than One Way To Dispatch It

There's More Than One Way To Dispatch It

There's More Than One Way To Dispatch It 2009 There's More Than One Way To Dispatch It Topological sorting of a directed acyclic graph

496 views • 36 slides
No! In fact, dynamic enforcement is as secure as Denning-style enforcement Trick: termination

No! In fact, dynamic enforcement is as secure as Denning-style enforcement Trick: termination

No! In fact, dynamic enforcement is as secure as Denning-style enforcement Trick: termination public:=0 channel Denning-style if secret enforcement termination-insensitive No assignments to public Monitor blocks variables

277 views • 11 slides
METRO WEST AMBULANCE DISPATCH CENTER Presented by Kristen Hoover & Larry Boxman DISPATCH

METRO WEST AMBULANCE DISPATCH CENTER Presented by Kristen Hoover & Larry Boxman DISPATCH

METRO WEST AMBULANCE DISPATCH CENTER Presented by Kristen Hoover & Larry Boxman DISPATCH CENTER 8 dispatch stations 2 supervisor consoles 5 call taker stations Dispatch Center Average of 1,200 phone calls in/out daily

392 views • 10 slides
Late Binding; OOP as a Racket Pattern Today Dynamic dispatch aka late binding aka virtual method

Late Binding; OOP as a Racket Pattern Today Dynamic dispatch aka late binding aka virtual method

Late Binding; OOP as a Racket Pattern Today Dynamic dispatch aka late binding aka virtual method calls Call to self.m2() in method m1 defined in class C can resolve to a method m2 defined in a subclass of C Most unique characteristic of

652 views • 11 slides
DSM Dispatch Conditions p Dr Richard Tooth 22 November 2012 2 Introduction Proposals in

DSM Dispatch Conditions p Dr Richard Tooth 22 November 2012 2 Introduction Proposals in

DSM Dispatch Conditions p Dr Richard Tooth 22 November 2012 2 Introduction Proposals in place affecting the dispatch of DSM Most notably, shift to unlimited hours of dispatch per year Also of relevance Minimum notice

500 views • 17 slides
Dynamic Policy Enforcement Dynamic Policy Enforcement in a Networked Environment in a Networked

Dynamic Policy Enforcement Dynamic Policy Enforcement in a Networked Environment in a Networked

Dynamic Policy Enforcement Dynamic Policy Enforcement in a Networked Environment in a Networked Environment Brandon Pollet Brandon Pollet Enterprise Security Group Enterprise Security Group Center for Information Security Center for

671 views • 28 slides
j i u a l The Unreasonable Effectiveness of Multiple Dispatch Stefan Karpinski Multiple

j i u a l The Unreasonable Effectiveness of Multiple Dispatch Stefan Karpinski Multiple

j i u a l The Unreasonable Effectiveness of Multiple Dispatch Stefan Karpinski Multiple Dispatch? dispatch dispatched on selection syntax degree arguments power none f(x, y) { } O(1) single x.f(y) {x} O(|X|) multiple

646 views • 30 slides
There's More Than One Way To Dispatch It Jonathan Worthington Nordic Perl Workshop 2009 There's

There's More Than One Way To Dispatch It Jonathan Worthington Nordic Perl Workshop 2009 There's

There's More Than One Way To Dispatch It Jonathan Worthington Nordic Perl Workshop 2009 There's More Than One Way To Dispatch It Single Dispatch We're used to writing subroutines with a name # Perl 6 sub taking one parameter $name sub

690 views • 43 slides
Costs 26 th May 2011 Agenda Introduction Overview of Dispatch Balancing Costs (30 mins)

Costs 26 th May 2011 Agenda Introduction Overview of Dispatch Balancing Costs (30 mins)

Operations Seminar Managing Dispatch Balancing Costs 26 th May 2011 Agenda Introduction Overview of Dispatch Balancing Costs (30 mins) Ongoing Management of Dispatch Balancing Costs (15 mins) Forecasting Dispatch Balancing Costs

1.15k views • 87 slides
in Hungary Enforcement procedure Procedure after Ordering enforcement enforcement order

in Hungary Enforcement procedure Procedure after Ordering enforcement enforcement order

Monitoring of enforcement in Hungary Enforcement procedure Procedure after Ordering enforcement enforcement order Ordering enforcement Authorities court notary public Enforcement order certificate of enforcement

540 views • 12 slides
Outline ROS Basics Plan Execution Very Simple Dispatch Very Simple Temporal

Outline ROS Basics Plan Execution Very Simple Dispatch Very Simple Temporal

Outline ROS Basics Plan Execution Very Simple Dispatch Very Simple Temporal Dispatch Conditional Dispatch Temporal and Conditional Dispatch together Dispatching More than a Single Plan Hierarchical and

1.69k views • 99 slides
Chittenden County Regional Dispatch Implementation Background 1. Why are we doing this? 2.

Chittenden County Regional Dispatch Implementation Background 1. Why are we doing this? 2.

Chittenden County Regional Dispatch Implementation Background 1. Why are we doing this? 2. DELTAWRX Recommendations 3. Governance Work Group Recommendations 4. Proposed next steps 5. Questions? 6. Dispatch Consolidation Roadmap PSAP

581 views • 57 slides
An Energy-Efficient Near/Sub-Threshold FPGA Interconnect Architecture Using Dynamic Voltage

An Energy-Efficient Near/Sub-Threshold FPGA Interconnect Architecture Using Dynamic Voltage

An Energy-Efficient Near/Sub-Threshold FPGA Interconnect Architecture Using Dynamic Voltage Scaling and Power-Gating He Qi, Oluseyi Ayorinde, and Benton H. Calhoun Charles L. Brown Department of Electrical and Computer Engineering University of

711 views • 20 slides
An Efficient Motion Planning Algorithm for Stochastic Dynamic Systems with Constraints on

An Efficient Motion Planning Algorithm for Stochastic Dynamic Systems with Constraints on

Massachusetts Institute of Technology An Efficient Motion Planning Algorithm for Stochastic Dynamic Systems with Constraints on Probability of Failure AAAI 08 Physically Grounded AI Special Track July 16 th 2008 Masahiro Ono and Brian C.

456 views • 45 slides
M ARVIN : Efficient And Comprehensive Mobile App Classification Through Static and Dynamic

M ARVIN : Efficient And Comprehensive Mobile App Classification Through Static and Dynamic

M ARVIN : Efficient And Comprehensive Mobile App Classification Through Static and Dynamic Analysis Martina Lindorfer, Matthias Neugschwandtner, Christian Platzer SBA Research, Vienna, Austria IBM Research, Zurich, Switzerland International

394 views • 25 slides
Automatic Generation of Efficient Dynamic Binary Translators Fr ed eric P etrot, Luc

Automatic Generation of Efficient Dynamic Binary Translators Fr ed eric P etrot, Luc

Introduction DBT principle Design flow Intermediate Representation Generation Conclusion Automatic Generation of Efficient Dynamic Binary Translators Fr ed eric P etrot, Luc Michel and Nicolas Fournel Tima Laboratory , Grenoble,

686 views • 25 slides
Dispatch and Scheduling Proposed Decision Dispatch and Scheduling Proposed Decision Jonathan

Dispatch and Scheduling Proposed Decision Dispatch and Scheduling Proposed Decision Jonathan

Dispatch and Scheduling Proposed Decision Dispatch and Scheduling Proposed Decision Jonathan OSullivan Dundalk, October 2010 d lk b Key Themes y Holistic Market Approach Holistic Market Approach Overall objectives Energy

960 views • 9 slides
Impact of server dynamic allocation on the response time for energy-efficient virtualized web

Impact of server dynamic allocation on the response time for energy-efficient virtualized web

Impact of server dynamic allocation on the response time for energy-efficient virtualized web clusters energy-efficient virtualized web clusters Carlos Oliveira, Vinicius Petrucci, Orlando Loques {cjunior, vpetrucci, loques} @ic.uff.br

388 views • 24 slides
Week3: Overview Essence of Dispatch, and Collections Damien Cassou, Stphane Ducasse and Luc

Week3: Overview Essence of Dispatch, and Collections Damien Cassou, Stphane Ducasse and Luc

Week3: Overview Essence of Dispatch, and Collections Damien Cassou, Stphane Ducasse and Luc Fabresse W3S00 http://www.pharo.org Schedule [Lecture] Essence of Dispatch: Taking Pharo Booleans as Example [Lecture] Essence of Dispatch

145 views • 3 slides

More recommend