Software Return Address Whitelist for ROP Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection mechanisms against Return-Oriented Programming (ROP) attacks are either vulnerable to automated attacks or suffer from high performance overhead, limiting their effectiveness in real-world implementations.
Innovation Solution
A method that involves modifying return operations in software code to verify that the return address corresponds to a call instruction for the same function, using additional checks for direct calls, and optionally incorporating tags or parsing call instructions to ensure the returning function matches the called function, thereby restricting the number of possible gadgets available to attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional code-injection attacks are used, then attackers can introduce code into vulnerable programs and change execution course, but modern protection mechanisms like DEP and W^X rules render these attacks ineffective
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing valid return addresses in a whitelist during system initialization or code analysis phase. This whitelist is then used at runtime to quickly validate return addresses, preventing ROP attacks without requiring complex runtime analysis or hardware support.
Solution Approach 2:
The patent creates a simplified copy or representation of the control flow graph (CFG) in the form of a whitelist containing valid return addresses. This copy allows fast validation without requiring the full complexity of the original CFG structure during runtime, achieving efficient ROP protection.
2Reliability
If Return-Oriented Programming (ROP) techniques are used to bypass DEP, then attackers can execute arbitrary code by chaining existing code sequences, but this increases the complexity of protecting against control-flow hijacking
Solution Approach 1:
The patent pre-computes the Control Flow Graph (CFG) and extracts all valid return addresses into a whitelist before runtime execution. This preliminary analysis phase captures all legitimate jump and call targets, enabling fast validation during runtime without complex analysis.
Solution Approach 2:
The patent creates a simplified representation of the CFG as a whitelist of valid return addresses. This copy allows O(1) validation of return addresses during runtime, avoiding the need for complex CFG traversal or hardware-assisted control-flow monitoring.
3Extent of automation
If automated ROP attack generation is implemented, then attackers can efficiently exploit vulnerabilities, but implementing equivalent automated protection increases system overhead
Solution Approach 1:
The patent performs automated CFG analysis and whitelist generation during system initialization or offline code analysis, moving the computationally intensive work away from runtime. This allows fast automated validation during execution without significant performance overhead.
Solution Approach 2:
The patent uses a simple, lightweight whitelist data structure that requires minimal memory and processing resources. This disposable-like structure can be quickly generated and validated, providing automated protection with minimal impact on system performance compared to complex runtime monitoring solutions.
4Reliability
If precise Control-Flow Integrity (CFI) enforcement is implemented, then return address validation is improved, but this introduces significant runtime overhead
Solution Approach 1:
The patent pre-computes all valid return addresses and stores them in a whitelist during initialization or offline analysis. This moves the complex validation logic from runtime to setup phase, enabling fast O(1) lookups during execution without significant performance overhead.
Solution Approach 2:
The patent creates a simplified copy of the control flow information in the form of a whitelist containing only valid return addresses. This copy enables fast validation without requiring the full complexity of the original CFG or hardware support, achieving precise CFI with minimal runtime overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method is provided for hardening low level software code against Return-oriented programming attacks. It builds by modifying calls and return functions so as to enable a check for direct calls to verify that that the returning function was effectively the one called by the preceding call, limiting the capacity of the attacker to redirect the control flow. This may in particular involve associating calls with special tags whose presence and value can be checked by the return function, or by a tagless approach in which the return function is defined so as to look for characterizing features of a call function in a predetermined position with respect to the call instruction, based on known structures for the applicable computer architecture.