Protection method and system for preventing stack overflow attack

Abstract

The invention discloses a protection method and system for preventing a stack overflow attack, and the method comprises the steps of constructing a canary value: constructing any canary value when a function call occurs; an insertion step: inserting the canary value into the called sub-function stack space for data filling; a recording step: adding a code in front of and behind the called sub-function respectively, and calculating an XOR result of the canary value and the return value respectively through the two codes; a comparison step: comparing the XOR results of the two canary values and the return value; an output step: if the XOR results are equal, returning the function jumps normally and a jump result; and if the XOR results are not equal, stopping program jump. According to the invention, the attack behavior that the return address is directly modified by bypassing the canary value can be detected under the condition that the calculation amount is as small as possible.

Description

technical field [0001] The invention belongs to the field of protection against stack overflow attacks, in particular to a protection method and system for preventing stack overflow attacks. Background technique [0002] In modern operating systems, applications are often difficult to achieve perfection, coupled with the limitations of programming languages, resulting in the emergence of various program vulnerabilities. Buffer overflow attack represented by stack overflow has become the most common security hole. Using it can destroy the normal execution process of the program, and more seriously, it can allow attackers to obtain system permissions through ordinary users to perform illegal operations on sensitive data, posing a great threat to the system environment. When an attacker exploits a stack overflow vulnerability, he usually destroys the current function stack. For example, the most common attack method is that the attacker uses the strcpy() function not to check...

AI Technical Summary

Problems solved by technology

[0005] The second is random value filling. The canary value is randomly generated when the program is initialized, and then this value is saved in a memory page that is not mapped into the virtual address space. When the attacker tries to access the memory that holds the random number through a pointer segfault

[0007] The existing technology has the following disadvantages: the first method of generating canary value uses fixed characters to fill the position of the canary word which is easy to be detected by the attacker. If the filling area is skipped and the subsequent data is directly modified, the protection method will be invalid; The second method of generating canary value will generate a random number padding, but this random number will be saved in the function stack, the attacker still has a chance to obtain the value of the function; the third method is to calculate a random number and all Although the method of controlling information and returning address values ​​can detect all control information and modifying return addresses, it involves a lot of calculations and consumes a lot

Images