JIT Code Randomization via Librando Security Library
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Just-in-time (JIT) compilers are vulnerable to attacks like JIT spraying and Return-Oriented Programming (ROP) due to their predictability, which allows attackers to inject and execute arbitrary native code, especially in sandbox environments, and existing security measures do not adequately protect dynamically generated code.
Innovation Solution
The implementation of a library called librando, which diversifies dynamically generated code through black-box and white-box approaches, using techniques like NOP insertion and constant blinding, to randomize code layout and prevent execution, thereby enhancing security without requiring changes to the JIT compiler's source code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If JIT compilers optimize code for performance by emitting predictable native code, then execution speed is improved, but security against attacks like JIT spraying and ROP deteriorates
Solution Approach 1:
The patent applies dynamics by making the code emission process adaptive and unpredictable. The JIT compiler dynamically selects among multiple possible native code translations for the same HLL code, and the selection criteria are designed to be unpredictable to attackers. This allows the system to maintain optimization while introducing variability that prevents attackers from reliably predicting code locations and structures, thereby countering JIT spraying and ROP attacks.
Solution Approach 2:
The patent changes the parameter of code translation predictability. Instead of always emitting the same optimal translation, the system varies which translation is emitted based on unpredictable factors. This parameter change ensures that while code remains optimized for performance, the specific native code generated varies in an unpredictable manner, preventing attackers from exploiting predictable code patterns.
2Reliability
If JIT compilers emit the same native code for the same HLL code repeatedly, then consistency and performance are improved, but security against code-reuse attacks deteriorates
Solution Approach 1:
The system maintains reliability by ensuring that functionally equivalent code is emitted, but introduces dynamic variability in the specific native code generated. The JIT compiler can emit different but functionally equivalent translations of the same HLL code, maintaining consistency in behavior while varying the actual byte sequences and their locations, thereby preventing code-reuse attacks that rely on identical repeated patterns.
3Object-affected harmful factors
If security measures are added to protect JIT generated code, then security is improved, but performance overhead increases
Solution Approach 1:
The patent applies preliminary action by incorporating security measures into the code generation process itself, rather than adding separate protection layers. The JIT compiler emits unpredictable and diversified native code directly, which inherently resists attacks like JIT spraying and ROP. This preliminary security integration avoids the need for additional runtime protection mechanisms, thereby minimizing performance overhead while maintaining strong security.
Data Source
AI summary
A system-wide service can simultaneously harden multiple running JITs, for example by hooking into the memory protections of a target operating system and randomizing newly generated code on the fly when marked as executable. Some embodiments preserve the contents of the calling stack, presenting each JIT with the illusion that it is executing its own generated code.