Shadow Stack Range Enforcement for Dynamic Code Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing shadow stack violation enforcement systems terminate an entire thread or process when a violation occurs, regardless of the specific code that triggered it, which can be impractical due to interactions with external modules or environments that unintentionally or maliciously tamper with return addresses.
Innovation Solution
Enforce shadow stack violations at module granularity, allowing for additional checks to determine if the violation occurred during execution of a called module, and only terminate the thread or process if shadow stack enforcement is enabled for that module, while permitting execution if it is not.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shadow stack enforcement is enabled for an entire thread, then security against stack buffer overflow attacks is improved, but false positives from external modules cause unnecessary thread termination
Solution Approach 1:
The patent segments shadow stack enforcement from thread-level to module-level by introducing per-module enforcement flags. Each module can independently specify whether shadow stack enforcement applies to it, allowing the system to enforce security for application code while permitting external modules that intentionally tamper with return addresses. This segmentation resolves the contradiction by enabling selective enforcement that maintains security where needed while ensuring compatibility with external modules.
2Reliability
If shadow stack violations are enforced strictly for the entire process, then protection against malicious code is improved, but legitimate dynamic code generation is blocked
Solution Approach 1:
The patent applies local quality by allowing different shadow stack enforcement policies for different modules within the same process. Managed runtimes can set enforcement flags on specific native libraries or dynamically loaded code, enabling strict enforcement for untrusted code while permitting flexible dynamic code generation in controlled environments. This local differentiation resolves the contradiction between security and adaptability.
3Device complexity
If shadow stack enforcement is applied uniformly, then security policy simplicity is maintained, but fine-grained control over different code regions is lost
Solution Approach 1:
The patent introduces dynamic module-level enforcement flags that can be set individually for each loaded module. The operating system maintains a data structure associating each module with an enforcement flag, allowing the enforcement policy to adapt dynamically based on the specific module being executed. This dynamic approach enables fine-grained control while maintaining a relatively simple enforcement mechanism through programmatic flag management.
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
Enforcing shadow stack violations for dynamic code. A thread is executed at a processor, which includes generating a portion of dynamic code for execution by the thread, identifying a range of memory addresses where the portion of dynamic code is loaded in memory, and initiating execution of the portion of dynamic code. Based at least on execution of the thread, an exception triggered by a mismatch between a first return address popped from a call stack corresponding to the thread and a second return address popped from a shadow stack corresponding to the thread is processed. Processing the exception includes (i) determining whether the second return address popped from the shadow stack is within the identified range of addresses, and (ii) based on having determined that the second return address is within the range of addresses, initiating a shadow stack enforcement action.