CRAlert: Hardware-Assisted Code Reuse Attack Detection

Abstract

Code reuse attack (CRA) hijacking the control flow of programs for malicious actions without injecting any codes, has brought great concerns to system security. Most existing defenses incur high performance overhead or require the instruction set architecture (ISA) extension and compiler modification. In this brief, we present <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CRAlert</monospace> , a new hardware-assisted CRA detection scheme, targets at mitigating the root causes of such code reuse attacks. <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CRAlert</monospace> is compatible with the current SW/HW environment without requiring any architectural modifications to the processor core. As the proof-of-concept, we prototype the proposed framework on a Xilinx ML605 FPGA. The experimental results demonstrate that <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CRAlert</monospace> could detect CRAs with an extremely low performance overhead (geometric mean) of 0.363%.