Feel me Flow: A Review of Control-Flow Integrity Methods for User - PowerPoint PPT Presentation

Feel me Flow: A Review of Control-Flow Integrity Methods for User and Kernel Space Irene Díez-Franco, Igor Santos DeustoTech, University of Deusto irene.diez@deusto.es isantos@deusto.es

Rationale

Rationale

Code injection attacks

Code injection attacks Control Flow Graph Intended flow Memory error

Code injection attacks Control Flow Graph Intended flow Memory error Attacker

Code injection attacks Control Flow Graph Intended flow Memory error Injected code Actual flow Attacker

Code injection attacks Code injection Control Flow Graph Intended flow Memory error Injected code Actual flow Attacker

Code injection attacks Code injection Data Execution Prevention (DEP) / Write XOR Execute (W ⊕ E) Canaries Control Flow Graph Intended flow Memory error Injected code Actual flow Attacker

Code reuse attacks

Code reuse attacks Control Flow Graph Intended flow Memory error

Code reuse attacks x0fo86 x0e58b Control Flow Graph Intended flow Memory error Attacker

Code reuse attacks x0fo86 x0e58b x0e58b x0fo86 Control Flow Graph Intended flow Memory error Attacker

Code reuse attacks x0fo86 x0e58b x0e58b Code reuse G G x0fo86 Control Flow Graph Intended flow Memory error G Gadget Actual flow Attacker

Code reuse attacks x0fo86 x0e58b x0e58b Code reuse G ASLR Kernel ASLR G → Statistical x0fo86 Control Flow Graph Intended flow Memory error G Gadget Actual flow Attacker

Code reuse attacks x0fo86 x0e58b x0e58b Code reuse G ASLR Kernel ASLR G → Statistical x0fo86 Control Flow Integrity (CFI) Control Flow Graph Intended flow Memory error G Gadget Actual flow Attacker

Control-Flow Integrity (CFI) Abadi et al. CCS’05

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 - Offline: CFG computation

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 - Offline: CFG computation

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 2 3 4 5 6 7 Control Flow Graph (CFG) 1 - Offline: CFG computation

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 2 3 4 5 6 7 Control Flow Graph (CFG) 2 - Runtime: CFG enforcement 1 - Offline: CFG computation

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 1 → {2, 3} 2 → {4, 5} 2 3 3 → {6} 4 → {2} 5 → {7} 4 5 6 6 → {7} 7 → { ∅ } 7 Control Flow Graph (CFG) Enforced CFG 2 - Runtime: CFG enforcement 1 - Offline: CFG computation

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 1 3 1 → {2, 3} 2 → {4, 5} 2 3 3 → {6} 4 → {2} 6 Execution 1 5 → {7} 4 5 6 6 → {7} 7 7 → { ∅ } 7 Control Flow Graph (CFG) Enforced CFG 2 - Runtime: CFG enforcement 1 - Offline: CFG computation

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 1 3 1 → {2, 3} 2 → {4, 5} 2 3 3 → {6} 4 → {2} 6 Execution 1 5 → {7} 4 5 6 6 → {7} 7 7 → { ∅ } 7 Control Flow Graph (CFG) Enforced CFG 2 - Runtime: CFG enforcement 1 - Offline: CFG computation

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 1 3 1 → {2, 3} 2 → {4, 5} 2 3 3 → {6} 4 → {2} 6 Execution 1 5 → {7} 4 5 6 6 → {7} 7 7 → { ∅ } 7 1 Control Flow Graph (CFG) Enforced CFG 2 Execution 2 5 2 - Runtime: CFG enforcement 1 - Offline: CFG computation

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 1 3 1 → {2, 3} 2 → {4, 5} 2 3 3 → {6} 4 → {2} 6 Execution 1 5 → {7} 4 5 6 6 → {7} 7 7 → { ∅ } 7 1 Control Flow Graph (CFG) Enforced CFG 2 Execution 2 5 2 - Runtime: CFG enforcement 1 - Offline: CFG computation

Control-Flow Integrity (CFI) Abadi et al. CCS’05 1 1 3 1 → {2, 3} 2 → {4, 5} 2 3 3 → {6} 4 → {2} 6 Execution 1 5 → {7} 4 5 6 6 → {7} 7 7 → { ∅ } 7 1 Control Flow Graph (CFG) Enforced CFG 2 Execution 2 5 2 - Runtime: CFG enforcement 1 - Offline: CFG computation

Control-Flow Integrity (CFI) - II x0fo86 x0e58b x0e58b Code reuse G G x0fo86 Attacker’s goal execution Original CFG Intended flow Memory error Gadget G Actual flow Attacker

Control-Flow Integrity (CFI) - II x0e58b G G x0fo86 Original CFG Intended flow Memory error Gadget G Actual flow Attacker

Control-Flow Integrity (CFI) - II x0fo86 x0e58b x0e58b Code reuse G G x0fo86 Abort execution Original CFG Intended flow Memory error Gadget G Actual flow Attacker

CFI Internals

CFI Internals Computation phase Flow sensitive VS flow insensitive

CFI Internals Computation phase Flow sensitive VS flow insensitive 1 | obj = &x; 2 | 3 | obj = &y;

CFI Internals Computation phase Flow sensitive VS flow insensitive obj at 1 → {x} obj → {x, y} 1 | obj = &x; obj at 2→ {y} 2 | 3 | obj = &y; Insensitive Sensitive

CFI Internals Computation phase Flow sensitive VS flow insensitive obj at 1 → {x} obj → {x, y} 1 | obj = &x; obj at 2→ {y} 2 | 3 | obj = &y; Insensitive Sensitive Context sensitive VS context insensitive

CFI Internals Computation phase Flow sensitive VS flow insensitive obj at 1 → {x} obj → {x, y} 1 | obj = &x; obj at 2→ {y} 2 | 3 | obj = &y; Insensitive Sensitive Context sensitive VS context insensitive A B C D E Where can we return to from function C?

CFI Internals Computation phase Flow sensitive VS flow insensitive obj at 1 → {x} obj → {x, y} 1 | obj = &x; obj at 2→ {y} 2 | 3 | obj = &y; Insensitive Sensitive Context sensitive VS context insensitive → B & E A B C Insensitive → B if called from B, D E E if called from E: Sensitive Where can we return to from function C?

CFI Internals Computation phase Enforcement phase Flow sensitive VS flow insensitive Forward vs backward control-flow transfers obj at 1 → {x} obj → {x, y} 1 | obj = &x; obj at 2→ {y} 2 | 3 | obj = &y; Insensitive Sensitive Context sensitive VS context insensitive → B & E A B C Insensitive → B if called from B, D E E if called from E: Sensitive Where can we return to from function C?

CFI Internals Computation phase Enforcement phase Flow sensitive VS flow insensitive Forward vs backward control-flow transfers obj at 1 → {x} obj → {x, y} 1 | obj = &x; Forward Backward obj at 2→ {y} 2 | 3 | obj = &y; A B A B Insensitive Sensitive Both Context sensitive VS context insensitive A B → B & E A B C Insensitive → B if called from B, D E E if called from E: Sensitive Where can we return to from function C?

CFI Internals Computation phase Enforcement phase Flow sensitive VS flow insensitive Forward vs backward control-flow transfers obj at 1 → {x} obj → {x, y} 1 | obj = &x; Forward Backward obj at 2→ {y} 2 | 3 | obj = &y; A B A B Insensitive Sensitive Both Context sensitive VS context insensitive A B → B & E A B C Insensitive Which control-flow → B if called from B, D E transfers do we E if called from E: take into account? Sensitive Where can we return to from function C?

Comparison fields

Comparison fields Control Flow Transfers Less secure Backward Forward More secure

Comparison fields Control Flow Transfers Less secure Backward Forward ∅ Every control flow transfer is allowed More secure

Comparison fields Control Flow Transfers Less secure Backward Forward ∅ Every control flow transfer is allowed Makes the assumption that two destinations Equivalent classes are equivalent if they come from the same source More secure

Comparison fields Control Flow Transfers Less secure Backward Forward ∅ Every control flow transfer is allowed Makes the assumption that two destinations Equivalent classes are equivalent if they come from the same source May or may not work on specially crafted Heuristics cases More secure

Comparison fields Control Flow Transfers Less secure Backward Forward ∅ Every control flow transfer is allowed Makes the assumption that two destinations Equivalent classes are equivalent if they come from the same source May or may not work on specially crafted Heuristics cases More secure

Comparison fields Control Flow Transfers Less secure Backward Forward ∅ Every control flow transfer is allowed Makes the assumption that two destinations Equivalent classes are equivalent if they come from the same source May or may not work on specially crafted Heuristics cases ( Hardware) Limited There is some restriction on full CS Context Sensitivity More secure

Comparison fields Control Flow Transfers Less secure Backward Forward ∅ Every control flow transfer is allowed Makes the assumption that two destinations Equivalent classes are equivalent if they come from the same source May or may not work on specially crafted Heuristics cases (Hardware) Limited There is some restriction on full CS Context Sensitivity Context Sensitive More secure