Indirect Branch Offset Validation for Code Reuse Attack Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Code reuse attacks exploit memory corruption vulnerabilities to manipulate indirect branch target addresses, allowing attackers to execute malicious code by chaining gadgets, which existing technologies fail to effectively mitigate.

Innovation Solution

Implementing a method that restricts the range of indirect jump instructions by validating target address offsets against a maximal offset value, raising exceptions for out-of-range offsets to prevent unauthorized control flow changes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If indirect jump instructions allow arbitrary target addresses, then program flexibility and control flow options are improved, but vulnerability to code reuse attacks increases

Engineering Contradiction:

Improveprogram flexibilityVSAvoidcode reuse attack vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent changes the parameter constraints of indirect jump instructions by introducing offset validation against a maximal offset value. This restricts the target address range to a safe window, transforming the unbounded address parameter into a bounded one that maintains program flexibility while preventing attacks.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent performs preliminary validation of the target address offset before executing the indirect jump. By checking whether the offset falls within the maximal offset value beforehand, the system prevents malicious jumps to arbitrary code locations while allowing legitimate control flow transitions.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If target address validation is implemented, then security against code reuse attacks is improved, but instruction execution overhead increases

Engineering Contradiction:

ImprovesecurityVSAvoidinstruction execution overhead

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent uses a simple comparison operation to validate offsets, which is a computationally inexpensive check. The validation logic is lightweight and can be executed quickly in the control path, minimizing the time overhead while providing robust security against code reuse attacks.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Object-affected harmful factors

If the maximal offset value is restricted, then the number of accessible gadgets is reduced mitigating attacks, but legitimate control flow options are limited

Engineering Contradiction:

Improveaccessible gadgetsVSAvoidcontrol flow options

Core Design Contradiction:

Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

The patent applies local quality by restricting the offset validation scope to a specific maximal offset value that is tailored to each indirect jump instruction's legitimate targets. This localized restriction ensures that only the necessary control flow options are limited, while maintaining flexibility for valid operations within the defined window.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS10607003B2Mitigation of code reuse attacks by restricted indirect branch instruction

Publication Date: 2020.03.31 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A method, computer program product and/or system is disclosed. According to an aspect of this invention, one or more processors receive an indirect jump instruction comprising a target address offset and a maximal offset value. One or more processors determine whether the target address offset is valid by comparison of the target address offset and the maximal offset value and one or more processors execute a jump operation based on whether the target address offset is valid. In some embodiments of the present invention, the jump operation comprises one or more processors executing an instruction located at a target address referenced by the target address offset if the target address offset is valid. In some embodiments, the jump operation further comprises one or more processors raising an exception if the target address offset is not valid.