Shadow Stack and Randomized Canary for JIT-ROP Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security measures are inadequate in defending against stack smashing, return-oriented programming (ROP), and just-in-time ROP (JIT-ROP) attacks, as attackers can bypass defenses by modifying return addresses and chaining gadgets in executable memory.
Innovation Solution
Enhancing security by randomizing stack canaries and implementing a shadow stack to encode and conceal return addresses, preventing overwrite attempts and detecting manipulation of control data, thereby fortifying the computing system against stack smashing and ROP attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If return addresses are stored on the call stack for normal program execution, then program control flow is maintained, but attackers can modify return addresses to perform stack smashing and ROP attacks
Solution Approach 1:
The patent divides the traditional single call stack into two separate stacks: a primary call stack for normal execution and a shadow stack for storing authenticated return addresses. This segmentation isolates the critical return address data from attacker modification while maintaining normal program control flow.
Solution Approach 2:
The shadow stack acts as an intermediary layer between the program execution and the return address storage. It mediates by storing authenticated return addresses separately and validating them during function returns, preventing direct attacker access to modify return addresses on the primary stack.
2Object-affected harmful factors
If memory addresses are randomized (ASLR) to defend against ROP attacks, then gadget location becomes difficult, but memory disclosure attacks can still locate gadgets
Solution Approach 1:
The system performs preliminary authentication and validation of return addresses before they are stored on the shadow stack. By pre-verifying that return addresses point to legitimate code regions, the system prevents attackers from exploiting even if they obtain memory address information through disclosure attacks.
Solution Approach 2:
The shadow stack implementation provides feedback mechanisms through authentication checks and validation processes. When a return address is attempted to be used, the system verifies its authenticity against the shadow stack, creating a feedback loop that blocks unauthorized control flow transitions even if addresses are disclosed.
3Object-affected harmful factors
If stack canaries are used to detect buffer overruns, then buffer smashing attacks are detected, but brute-force attacks can still discover canary values
Solution Approach 1:
The patent changes the parameter of canary values from static or easily predictable values to dynamically generated authenticated values. Each canary is cryptographically authenticated and tied to specific stack frames, making brute-force attacks computationally infeasible while maintaining effective buffer overrun detection.
Solution Approach 2:
The system combines multiple security mechanisms into a composite protection scheme: authenticated canaries with cryptographic validation, shadow stack separation, and return address authentication. This composite approach layers multiple defense mechanisms where each component strengthens the others, preventing brute-force discovery while maintaining detection capabilities.
Data Source
AI summary
Improved systems and methods of providing computer security and countering attacks on computing systems by protecting control data such as a return address from being disclosed or modified. A stack canary is enhanced with randomization to prevent brute-force attacks and information leakage, providing a more effective sentinel to detect attempts to overwrite a return address on the stack. A shadow stack is enhanced with concealment of the return address from the stack, encoding of the return address in memory, and replacement of the real return address with a substitute value to detect attempted manipulation of the return address on the call stack and prevent it from succeeding. By enhancing randomization of the stack canary and using a shadow stack to encode and conceal the return address, the disclosed technology enhances security of a computing system against stack smashing, ROP attacks, and JIT-ROP attacks.