Code Reuse Prevention through Control Flow Lazily Check

Abstract

Despite the numerous prevention and protection techniques that have been developed, the exploitation of memory corruption vulnerabilities still represents a serious threat to the security of software systems and networks. Because of the adoption of the write or execute only policy (W¨'X) and address space layout randomization (ASLR), modern operate systems have been strengthened against code injection attacks. However, attackers have responded by employing code reuse attacks, in which software vulnerability is exploited to weave control flow through existing code base. Solutions targeting different aspects of the attack itself have had some success, but none of them can be a silver bullet. Under this situation, it is necessary to develop a general prevention to mitigate code reuse attacks. In this paper, we present a novel and general defense technique called control flow lazily check (CFLC), which allows for effective enforcement of control flow integrity. Specifically, instead of immediately determining the violation of control flow before the control flow transfer takes place, CFLC detects the violation after the transfer. Further, CFLC ensures that no deviation can be used to bypass the checking code and craft a malicious system call neither. To reduce the performance overhead, we introduce a coarse-grained CFLC based on the principle that a success intrusion must invoke a system call. We have implemented CFLC with the help of dynamic binary instrumentation tool and the evaluation demonstrates that CFLC can not only prevent code reuse attacks but also code injection attacks. It is shown that CFLC has achieved significant safety than other existing defenses with a modest performance penalty.