Timely Address Space Randomization for Code Reuse Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory randomization techniques, such as ASLR, are ineffective against code reuse attacks that exploit memory disclosure vulnerabilities, as attackers can leak memory content and hijack control flow, rendering fine-grained variants of ASLR ineffective.
Innovation Solution
Implement timely address space randomization by synchronizing memory layout randomization with potential runtime disclosure, re-randomizing the location of executable code every time an attacker has an opportunity to observe the system, using a re-randomizer component that detects output-input call pairs to update and relocate code regions within the address space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Address Space Layout Randomization (ASLR) is performed once during program startup, then the location of code in memory is obscured, but memory content can still be leaked through vulnerabilities and used to bypass the randomization
Solution Approach 1:
The patent implements dynamic address space randomization by continuously relocating code regions during program execution rather than performing static randomization at startup. The system periodically changes the memory layout of code regions, making it impossible for attackers to reliably use leaked memory content for code reuse attacks, as the target locations change over time.
Solution Approach 2:
The patent employs periodic re-randomization of memory layouts at scheduled intervals during program execution. This periodic action ensures that even if an attacker manages to leak memory content at one point, the information becomes stale and unusable by the next re-randomization cycle, effectively countering code reuse attacks while maintaining manageable system complexity through structured periodic operations.
2Reliability
If code region locations are re-randomized frequently, then code reuse attacks are thwarted, but program execution performance may degrade
Solution Approach 1:
The patent applies partial re-randomization by selectively relocating only code regions that are potential targets for code reuse attacks, rather than re-randomizing the entire address space. This selective approach provides sufficient attack resistance while minimizing the performance overhead associated with frequent comprehensive memory operations.
Solution Approach 2:
The system dynamically adjusts the re-randomization frequency and scope based on detected threat levels and program execution phases. By changing parameters such as relocation interval and target selection criteria, the system optimizes the balance between security effectiveness and execution performance, reducing overhead during normal operation while maintaining strong protection against attacks.
Data Source
AI summary
A method for timely address space randomize includes loading a code region from a program binary to a first location within the address space, detecting, during execution of the program, an output-input call pair from the program and, in response to detecting the output-input call pair from the program: selecting a second location within the address space to move the code region to, determining memory locations of one or more references to the code region, updating the values of the references in memory based on the second location and using annotation information within the program binary, and moving the code region to the second location within the address space.