Return Address Shadow Stack for Stack Smashing Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern data processing systems are vulnerable to stack smashing attacks due to overwriting of return addresses on the program stack, which can alter the program flow and lead to unauthorized control, as existing methods like relocating the stack or using guard variables or shadow stacks do not fully prevent such overflows.
Innovation Solution
A data processing system that uses a separate memory for storing return address copies, where the return address is compared with its copy before execution, generating an exception message if they do not match, and allowing continued execution using the copy to prevent stack overflow attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If return addresses are stored on the program stack in a continuous memory section, then the data processing system operates efficiently with simple memory access, but the system becomes vulnerable to stack smashing attacks where return addresses can be overwritten by adjacent stack data
Solution Approach 1:
The patent divides the return address storage into two separate segments: the main program stack for normal operations and a shadow stack specifically for storing return addresses. This segmentation isolates return addresses from other stack data, preventing overwriting attacks while maintaining efficient access through dedicated stack pointer management.
Solution Approach 2:
The shadow stack acts as an intermediary protective layer between the main stack and the control flow. By storing return addresses in this intermediate structure and using shadow frame pointers to access them, the system mediates the vulnerability without requiring fundamental changes to the calling convention or main stack operations.
2Reliability
If the entire stack is relocated to a random memory location to prevent attacks, then security against stack smashing is improved, but the overhead of relocation and erasure operations reduces system performance
Solution Approach 1:
The shadow stack is pre-configured and ready before any potential attack occurs. Return addresses are continuously pushed to the shadow stack during normal execution, so protection is already in place before an overflow can happen. This eliminates the need for reactive relocation operations that would degrade performance.
Solution Approach 2:
Instead of relocating the entire stack, the patent creates a copy of return addresses in the shadow stack. This copying approach provides security without requiring movement of large memory blocks, avoiding the performance penalty associated with stack relocation while maintaining protection through the duplicated return address information.
3Reliability
If guard variables are inserted before return addresses to detect overwriting, then detection capability is improved, but the additional memory usage and checking overhead increase system complexity
Solution Approach 1:
The shadow stack creates a complete copy of return addresses in a separate, protected structure. This copying provides inherent protection without needing additional guard variables, as the shadow stack's separate memory location and dedicated shadow frame pointers naturally prevent overwriting while maintaining constant-time access for verification.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A data processing system (10) comprising a processing unit (12), a first memory (14), and a second memory (16), wherein the data processing system (10) is arranged to hardware protect the second memory (16) when a write access to the first memory (14) is executed, wherein the processing unit (12) is arranged to execute a program (18) having at least one jump instruction (20) and at least one return instruction (22), wherein the processing unit (12) is arranged to store a program stack (24) in the first memory (14), wherein the processing unit (12) is arranged to store a return address (26) on the program stack (24) and to store a return address copy in the second memory (16) when the at least one jump instruction (20) is executed, and wherein the processing unit (12) is arranged to compare the return address (26) with the return address copy when the at least one return instruction (22) is executed.