Return Address Predictor for Stack Verification Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software execution models are vulnerable to security exploits, such as stack overflow and return-oriented programming attacks, which manipulate return addresses to alter control flow, posing a challenge in protecting against malicious code execution.
Innovation Solution
The implementation of a control stack in addition to the data stack, combined with the use of a return address stack in the branch prediction unit, allows for reduced overhead in verifying return addresses by leveraging the branch predictor's prediction accuracy to minimize explicit checks between the control and data stacks, except in cases of misprediction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If explicit checks are performed between control stack and data stack for every return instruction, then security against malicious code execution is improved, but processing overhead increases
Solution Approach 1:
The branch predictor performs return address verification in advance by comparing predicted return addresses from the return address stack with actual return addresses from the data stack before instruction execution. This preliminary verification allows the system to identify and handle potential security threats before they impact normal processing flow, reducing the need for frequent explicit checks during execution.
Solution Approach 2:
A return address stack is introduced as an intermediary data structure within the branch predictor that mirrors the control stack. This intermediary allows indirect verification of return addresses by comparing it with the data stack, providing security validation without requiring direct, frequent interactions between the control stack and data stack, thereby reducing processing overhead.
2Measurement precision
If return address verification is performed frequently, then detection of malicious control flow changes is improved, but system performance deteriorates
Solution Approach 1:
The branch predictor's return address stack automatically mirrors the control stack through the branch prediction mechanism, providing self-verification of return addresses. The misprediction detection mechanism inherently validates return address integrity without requiring additional explicit checks, allowing the system to maintain high detection accuracy while minimizing performance impact through self-service validation.
Solution Approach 2:
The misprediction detection mechanism provides continuous feedback on return address validity by comparing predicted and actual return addresses. When a mismatch is detected, the system can trigger security protocols. This feedback-based approach enables accurate detection of malicious control flow changes while maintaining system performance by only activating full verification when necessary.
Data Source
AI summary
Overhead associated with verifying function return addresses to protect against security exploits is reduced by taking advantage of branch prediction mechanisms for predicting return addresses. More specifically, returning from a function includes popping a return address from a data stack. Well-known security exploits overwrite the return address on the data stack to hijack control flow. In some processors, a separate data structure referred to as a control stack is used to verify the data stack. When a return instruction is executed, the processor issues an exception if the return addresses on the control stack and the data stack are not identical. This overhead can be avoided by taking advantage of the return address stack, which is a data structure used by the branch predictor to predict return addresses. In most situations, if this prediction is correct, the above check does not need to occur, thus reducing the associated overhead.