Control Transfer Termination Instructions for ROP Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques to defend against return-oriented programming (ROP) attacks are ineffective, allowing attackers to execute unintended control transfers and exploit vulnerabilities in computer systems by using sequences of instructions that end with return instructions.
Innovation Solution
The introduction of control transfer termination (CTT) instructions, such as ENDBRANCH and ENDRET, which are used to specify valid control transfer points, ensuring that control transfers only occur to programmer-intended locations, thereby preventing unintended gadgets from being executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control transfer instructions (RET, CALL, JMP) are allowed to execute without restriction, then program flexibility and normal control flow are maintained, but systems become vulnerable to ROP attacks and unintended control transfers
Solution Approach 1:
The patent applies preliminary action by inserting control transfer termination instructions (CTT instructions like ENDBRANCH and ENDRET) at specific locations in the code before execution reaches potential attack vectors. These CTT instructions are placed in advance to mark valid control transfer targets, so when a RET instruction executes, the processor can immediately verify whether the target address corresponds to a pre-marked valid location, preventing ROP attacks before they can exploit unintended control transfers
Solution Approach 2:
The patent introduces CTT instructions as intermediary elements between control transfer instructions and their targets. When a control transfer instruction executes, the processor inserts a CTT instruction at the target address as a mediator that verifies the transfer's legitimacy. This intermediary mechanism allows the system to maintain normal control flow flexibility while adding a security layer that blocks malicious transfers without affecting legitimate program execution
2Reliability
If CTT instructions are inserted to prevent ROP attacks, then security against unintended control transfers is improved, but code density decreases and executable size increases
Solution Approach 1:
The patent applies local quality by selectively inserting CTT instructions only at specific strategic locations rather than throughout the entire codebase. CTT instructions are placed at function epilogues, known valid control transfer targets, and other critical points where control transfers legitimately occur. This localized approach provides comprehensive security coverage while minimizing the total number of CTT instructions needed, thus reducing the impact on code size
Solution Approach 2:
The patent enhances the utility of each CTT instruction by designing them to serve multiple functions: they mark valid control transfer targets, provide security verification points, and can also serve as optimization hints for the processor. This multi-functionality means that a single CTT instruction insertion provides broader security coverage and potential performance benefits, reducing the overall quantity of CTT instructions needed compared to approaches that require dedicated verification mechanisms at every possible transfer point
3Reliability
If CTT instructions are used to enforce valid control transfer locations, then the number of usable gadgets is reduced, but this may impact legitimate control flow operations
Solution Approach 1:
The patent applies preliminary action by pre-marking all legitimate control transfer targets with CTT instructions during the compilation or code generation phase. This ensures that all valid control flow operations (function calls, returns, jumps) are anticipated and marked in advance, so the runtime security mechanism recognizes them as legitimate. Legitimate control flow operations are thus preserved because their targets were pre-identified and marked during development, while unintended gadgets lacking CTT markers are blocked
Data Source
AI summary
In an embodiment, the present invention includes a processor having an execution logic to execute instructions and a control transfer termination (CTT) logic coupled to the execution logic. This logic is to cause a CTT fault to be raised if a target instruction of a control transfer instruction is not a CTT instruction. Other embodiments are described and claimed.