Stack Bounds Checking Logic for ROP Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems are vulnerable to unauthorized stack pivoting in return-oriented programming (ROP) attacks, where attackers modify the return address on the stack to divert the execution flow to arbitrary memory locations, posing a significant security risk.
Innovation Solution
Implementing a pair of stack bound registers within the processor to store stack bounds, and employing stack bounds checking logic to compare accessed memory addresses with these bounds, generating a stack fault exception if the address is outside the permissible range, thus preventing unauthorized stack modification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If stack bounds checking logic is implemented to prevent unauthorized stack pivoting, then security against ROP attacks is improved, but device complexity increases due to additional registers and checking mechanisms
Solution Approach 1:
The stack segment is divided into bounded regions using stack bound registers (SS0, SS1, SS2, SS3) that define permissible access ranges. This segmentation isolates the stack into secure segments, preventing attackers from pivoting to arbitrary memory locations while maintaining structured access control.
Solution Approach 2:
Stack bounds are pre-configured in the stack bound registers before stack operations occur. The system proactively establishes security boundaries in advance, so that when stack access occurs, the checking logic can immediately verify whether the access is authorized without requiring complex runtime analysis.
2Measurement precision
If stack bounds checking logic compares every memory access with stack bounds, then detection precision of unauthorized pivoting is improved, but processing speed decreases due to additional comparison operations
Solution Approach 1:
The checking logic performs partial verification by comparing only the critical boundary conditions (whether access is within SS0-SS3 ranges) rather than exhaustive analysis of all stack operations. This selective checking maintains high detection precision for unauthorized pivoting while minimizing the processing overhead.
Solution Approach 2:
The stack bound registers act as intermediaries that pre-store the boundary values, allowing the checking logic to perform simple register-to-register comparisons rather than complex calculations. This intermediary mechanism speeds up the detection process by replacing sophisticated analysis with straightforward boundary checks.
Data Source
AI summary
An example processing system may comprise: a lower stack bound register configured to store a first memory address, the first memory address identifying a lower bound of a memory addressable via a stack segment; an upper stack bound register configured to store a second memory address, the second memory address identifying an upper bound of the memory addressable via the stack segment; and a stack bounds checking logic configured to detect unauthorized stack pivoting, by comparing a memory address being accessed via the stack segment with at least one of the first memory address and the second memory address.