JIT Compiler Output Protection via Dynamic Code Rewriting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Just-in-time (JIT) spraying attacks exploit the behavior of JIT compilers, circumventing address space randomization and data execution prevention by generating identical sequences of native instructions, posing a security threat in data center networks.
Innovation Solution
A system and method that intervene from outside the JIT compiler to protect its output by rewriting the JIT page, generating a shadow page, randomly moving instructions, and replacing them with invalid opcodes or halt instructions, making the execution flow unpredictable and difficult for attackers to exploit.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If JIT compiler generates identical sequences of native instructions for security analysis, then security monitoring capability is improved, but vulnerability to JIT spraying attacks increases
Solution Approach 1:
The patent applies dynamics by making the JIT code page content changeable over time. The system dynamically replaces portions of JIT-generated code with invalid opcodes or halt instructions during runtime, transforming the static code structure into a dynamic one that adapts to prevent exploitation while maintaining monitoring capabilities
Solution Approach 2:
The patent introduces an intermediary mechanism between the JIT compiler and the executed code. A protection layer is inserted that mediates access to JIT code pages, allowing security monitoring while preventing direct exploitation by attackers through the intermediary's control and validation functions
2Reliability
If address space randomization is used to protect code execution, then execution security is improved, but JIT spraying attacks can still circumvent it by generating identical instruction sequences
Solution Approach 1:
The patent applies asymmetry by creating an uneven structure in the code protection mechanism. While address space randomization provides symmetric protection, the system introduces asymmetric elements by selectively replacing specific portions of code with invalid opcodes, creating an uneven landscape that disrupts attacker patterns while maintaining legitimate execution
Solution Approach 2:
The patent applies preliminary action by proactively replacing code portions with invalid opcodes before attackers can exploit them. The system preemptively modifies JIT code pages by inserting halt instructions and invalid opcodes at strategic locations, preventing potential exploitation before it occurs
Data Source
AI summary
An example method for mitigating JIT spraying attacks in a network environment is provided and includes protecting an output of a just-in-time (JIT) compiler against attacks during application execution at least by intervening from outside the application into a JIT page generated by the JIT compiler in a memory element of a host. In a specific embodiment, the intervening can include rewriting the JIT page. In specific embodiments, the method can further include generating a shadow page corresponding to the JIT page in the memory element. The method can further include randomly choosing at least one block of instructions in the JIT page, moving the at least one block of instructions to the shadow page, and replacing the at least one block of instructions in the JIT page with at least one of invalid opcodes and halt instructions.