Breaking Active-Set Backward-Edge Control-Flow Integrity

Michael Theodorides

EECS Department, University of California, Berkeley

Technical Report No. UCB/EECS-2017-78

May 12, 2017

This publication is archived. It is kept only for reference purposes, so it is no longer being updated and may not meet accessibility standards. If you need this content in a different format, please email webteam@eecs.berkeley.edu.

http://www2.eecs.berkeley.edu/Pubs/TechRpts/2017/Archive/EECS-2017-78.pdf

Hardware-Assisted Flow Integrity eXtension (HAFIX) was proposed as a defense against code-reuse attacks that exploit backward edges (returns). HAFIX provides fine-grained protection by implementing Active-Set Backward-Edge CFI: confining return addresses to only target call sites in functions active on the call stack. We study whether the active-set backward-edge CFI policy is sufficient to prevent code-reuse exploits on real-world programs. In this thesis, we present five novel attacks that exploit weaknesses in active-set backward-edge CFI and demonstrate these attacks are effective in case studies examining Nginx web server, Exim mail server, and PHP. We then propose improvements to active-set backward-edge CFI that we believe will improve its effectiveness against code-reuse attacks.

Advisors: David Wagner

BibTeX citation:

@mastersthesis{Theodorides:EECS-2017-78,
    Author= {Theodorides, Michael},
    Title= {Breaking Active-Set Backward-Edge Control-Flow Integrity},
    School= {EECS Department, University of California, Berkeley},
    Year= {2017},
    Month= {May},
    Url= {http://www2.eecs.berkeley.edu/Pubs/TechRpts/2017/EECS-2017-78.html},
    Number= {UCB/EECS-2017-78},
    Abstract= {Hardware-Assisted Flow Integrity eXtension (HAFIX) was proposed as a defense against code-reuse attacks that exploit backward edges (returns). HAFIX provides fine-grained protection by implementing Active-Set Backward-Edge CFI: confining return addresses to only target call sites in functions active on the call stack. We study whether the active-set backward-edge CFI policy is sufficient to prevent code-reuse exploits on real-world programs.
In this thesis, we present five novel attacks that exploit weaknesses in active-set backward-edge CFI and demonstrate these attacks are effective in case studies examining Nginx web server, Exim mail server, and PHP.  We then propose improvements to active-set backward-edge CFI that we believe will improve its effectiveness against code-reuse attacks.},
}

EndNote citation:

%0 Thesis
%A Theodorides, Michael 
%T Breaking Active-Set Backward-Edge Control-Flow Integrity
%I EECS Department, University of California, Berkeley
%D 2017
%8 May 12
%@ UCB/EECS-2017-78
%U http://www2.eecs.berkeley.edu/Pubs/TechRpts/2017/EECS-2017-78.html
%F Theodorides:EECS-2017-78