SCFI: Efficient forward fine-grained control flow integrity based on coarse-grained ISA extensions

Abstract

Code reuse attack (CRA) is a severe threat to computer systems. To mitigate this threat, control-flow integrity (CFI) was proposed to restrict control-flow transfers. Processor vendors developed Instruction Set Architecture (ISA) extensions to enforce forward CFI on processors, such as Indirect Branch Tracking (IBT) developed by Intel and Branch Target Identification (BTI) developed by ARM. However, these extensions are coarse-grained and unable to provide enough security protection.We combine existing coarse-grained ISA extension with novel software modifications and propose a new fine-grained forward CFI implementation called Slot-based CFI (SCFI). SCFI consists of two software modifications: Slot Policy and ID Policy. Slot policy utilises lower bits of code address as labels to implement fine-grained CFI. ID Policy provides multi-label support to solve the destination equivalence problem. SCFI strengthens security by improving coarse-grained ISA extension to fine-grained CFI (improving Average Indirect Targets Allowed (AIA) from 752 to 6.24). SCFI costs negligible performance overhead (on average 0.78% in SPEC2006). It also has good performance in complex programs (1.12% in 471.omnetpp and 1.79% in 483.xalancbmk). In addition, SCFI only needs lightweight software instrument without hardware modification and supports complex control-flow graphs.