No-Execute Feature Protection Against Register Write Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Buffer overflow attacks can compromise computer systems by allowing malicious code to execute and disable the no-execute processor feature, granting unauthorized access.
Innovation Solution
A method that stalls the execution of a model specific register write function and checks if the no-execute field in the processor's model specific register is being altered, taking protective action to prevent disabling of the no-execute processor feature when changes are detected, thereby preventing malicious code from disabling the no-execute feature.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the no-execute processor feature is enabled to prevent buffer overflow attacks, then system security is improved, but the system becomes vulnerable to attacks that attempt to disable the no-execute feature by altering model specific registers
Solution Approach 1:
The patent applies preliminary action by monitoring model specific register writes before they can execute malicious code. The system proactively detects attempts to alter the no-execute field and prevents these changes, thereby maintaining security without waiting for actual exploitation to occur.
Solution Approach 2:
The patent introduces an intermediary mechanism that intercepts and monitors model specific register write operations. This intermediary layer between normal program execution and the processor registers prevents malicious code from directly modifying the no-execute field, thus resolving the contradiction between security and vulnerability.
2Reliability
If the no-execute field is made immutable to prevent disabling, then security is improved, but legitimate software that needs to modify processor features cannot do so
Solution Approach 1:
The patent applies local quality by making the no-execute field specifically immutable while allowing other model specific registers to remain writable. This selective immutability preserves security for the critical no-execute feature while maintaining software flexibility for other processor configurations.
Solution Approach 2:
The system performs preliminary monitoring of register write attempts and only blocks writes to the no-execute field while allowing other register modifications. This preliminary detection and selective prevention maintains both security and software adaptability.
Data Source
AI summary
A method includes stalling execution of a model specific register write function to write to a model specific register of a processor having a no-execute processor feature enabled, determining that the model specific register is a no-execute model specific register of the processor, and determining whether a no-execute field in the no-execute model specific register is being altered. Upon a determination that the no-execute field is being altered, the method further includes taking protective action to prevent disabling of the no-execute processor feature.