SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by...

34
SoK: Shining Light on Shadow Stacks Nathan Burow, Xinping Zhang, Mathias Payer

Transcript of SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by...

Page 1: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

SoK: Shining Light on Shadow Stacks

NathanBurow,XinpingZhang,MathiasPayer

Page 2: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Control-Flow Hijacking (CFH)

• Microsoft:70%ofbugsarememorycorruptions

• ControlandDataPlanesareinterleaved

• MemorycorruptionàControl-FlowHijacking

2Data CodePointer

Page 3: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Control-Flow Hijacking (CFH)

• Microsoft:70%ofbugsarememorycorruptions

• ControlandDataPlanesareinterleaved

• MemorycorruptionàControl-FlowHijacking

3Data CodePointer

Page 4: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Forward Edge

•  Functionpointers;virtualcalls

• Control-FlowIntegrity(CFI)–staticallycalculatestargetsets

4

Page 5: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Forward Edge

•  Functionpointers;virtualcalls

• Control-FlowIntegrity(CFI)–staticallycalculatestargetsets

5

fptr()

Page 6: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Forward Edge

•  Functionpointers;virtualcalls

• Control-FlowIntegrity(CFI)–staticallycalculatestargetsets

6

fptr()

Page 7: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Backward Edge

• ReturnInstructions• DoesCFIstyleanalysiswork?

7

Page 8: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Backward Edge

• ReturnInstructions• DoesCFIstyleanalysiswork?

8

ret

Page 9: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Backward Edge

• ReturnInstructions• DoesCFIstyleanalysiswork?

9

NO

Page 10: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Backward Edge

• CFIstyletargetsetsincludeeverycallsiteforthefunction

•  Targetsetsaretoolargetoprovidemeaningfulprotection

10

Securityrequiresintegrityforreturnaddresses!

Page 11: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

CFH Mitigation Today

•  SeminalCFIpaperbyAbadiet.al.calledforshadowstack

•  SeeBurowetalCSUR2017[1]

• DeployedversionsbyMicrosoft/Googleonlycoverforwardedge

11

Noequallystrongdefenseforbackwardedge!

[1]Burowet.al.“Control-flowintegrity:Precision,security,andperformance.”CSUR2017.

Page 12: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Shadow Stacks

•  Separatereturnaddressesfromdataplane

• Provideintegrityprotectionforreturnaddresses

• Performantandhighlycompatible

12

NeedtodeployShadowStackwithCFI!

Page 13: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Control-Flow Hijacking Illustrated ProgramStack

ReturnAddress

StackCanary

Array

Pointer

13

Page 14: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Control-Flow Hijacking Illustrated ProgramStack

ReturnAddress

StackCanary

Array

Pointer

14

Page 15: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Control-Flow Hijacking Illustrated ProgramStack

ReturnAddress

StackCanary

Array

Pointer

15

Page 16: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Control-Flow Hijacking Illustrated ProgramStack

ReturnAddress

StackCanary

Array

Pointer

16

Page 17: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Control-Flow Hijacking Illustrated ProgramStack

ReturnAddress

StackCanary

Array

Pointer

17

Page 18: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Control-Flow Hijacking Illustrated ProgramStack

ROPPointer

StackCanary

Array

Pointer

18

Page 19: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

What is a Shadow Stack?

⋮

foo()

bar()

ReturnAddress

ReturnAddress

ProgramStack ShadowStack

ReturnAddress

⋮ReturnAddress

19

Page 20: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Shadow Stack Defense ProgramStack

ROPPointer

StackCanary

Array

Pointer

ShadowRA

ShadowStack

20

Page 21: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Shadow Stack Defense ProgramStack

ROPPointer

StackCanary

Array

Pointer

ShadowRA

ShadowStack

21

Page 22: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Shadow Stack Defense ProgramStack

ROPPointer

StackCanary

Array

Pointer

ShadowRA

ShadowStack

❌

22

Page 23: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Advantages of Shadow Stacks

• Knowatruntimewhatfunctionyouwerecalledfrom

• Dynamicdefense–doesNOTrelyonstaticanalysis

•  Separatescodeanddataplanesforbackwardedges

23

Fullyprecisebackwardedgeprotection!

Page 24: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Shadow Stack Design Space

24

[1]T.H.Dang,P.Maniatis,andD.Wagner,“Theperformancecostofshadowstacksandstackcanaries,”inAsiaCCS’15[2]T.-c.ChiuehandF.-H.Hsu,“Rad:Acompile-timesolutiontobufferoverflowattacks,”inICDCS’01[3]L.Davi,A.-R.Sadeghi,andM.Winandy,“Ropdefender:Adetectiontooltodefendagainstreturn-orientedprogrammingattacks,”inAsiaCCS’11

[1] [2],[3]

Stack Stack

Shadow Stack

8MB

8MB

constant

Direct Mapping

Stack Stack

Shadow Stack

8MB

Indirect Mapping

Grows on demand

Page 25: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Recommended Shadow Stack

•  Indirectmapping

• Useageneralpurposeregisterforshadowstackpointer

25

Optimalperformanceandhighcompatibility!

Page 26: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Recommended Mapping

•  IndirectMapping

• Asperformantasdirectmapping

• Minimizesmemoryoverhead

26

Fastestmappinghaslowestmemoryoverhead!

Page 27: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Recommended Encoding

• Usegeneralpurpose(GP)registerforshadowstackpointer

• Doesnotincreaseregisterpressure

•  Significantoptimizationforshadowstacks

27

Dedicatingaregistertotheshadowstackpointerisaneffectiveoptimization!

Page 28: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Compatibility of Recommended Shadow Stack

•  Threading:fullysupported.GPregistersarethreadlocal

•  StackUnwinding:provideinstrumentedsetjmp/longjmp

• UnprotectedCode:saveandrestoreshadowstackpointer

28

Supportallapplicationsandincrementaldeployment!

Page 29: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Intra-Process Memory Isolation

•  ShadowStacksplitscodeanddataplanes

•  Enablesintegrityenforcementbyisolatingreturnaddresses

29

ShadowStacksenablecodepointerintegrityforreturnaddresses!

Page 30: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Intra-Process Memory Isolation

•  Softwarebasedrandomizationdefensearedefeasible

•  IntelMPXusesboundschecksforisolation,moderateperformance

•  IntelMPKchangespermissionsofpages,slowperformance

30

Noneofthesearefullysatisfactory.Taggedarchitecturesareapromisingnewapproach.

Page 31: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

SPEC CPU2006 Performance Evaluation

31

ShadowStack

GeometricMean Max Min

Direct 5.78% 38.68% 0.00%

Recommended 3.65% 9.70% 0.00%

Page 32: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

SPEC CPU2006 Performance Evaluation

32

ShadowStack

GeometricMean Max Min

Direct 5.78% 38.68% 0.00%

Recommended 3.65% 9.70% 0.00%

Page 33: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

SPEC CPU2006 – Integrity Enforcement

33

IntegrityScheme

GeometricMean Max Min

Randomization 4.31% 13.68% 0.00%

MPX 12.12% 33.02% 2.47%

MPK 61.18% 419.81% 0.00%

Page 34: SoK: Shining Light on Shadow Stacks · • See Burow et al CSUR 2017[1] • Deployed versions by Microsoft / Google only cover forward edge 11 No equally strong defense for backward

Conclusion

•  Stackremainsvulnerabletocodereuseattacks

• Needtoseparatereturnaddressesfromdataplane

• Recommendacompact,registerbasedshadowstackfordeployment

34

ShadowStacks+CFI=practicalCFHmitigation

https://github.com/HexHive/ShadowStack


SOK Corporation´s 2016

SOK Corporation´s 2016

SPE/CSUR Unconventional Resources Conference · The Technology Spotlight is a new feature of the 2015 SPE/CSUR Unconventional Resources Conference. It is an interactive, educational

SPE/CSUR Unconventional Resources Conference · The Technology Spotlight is a new feature of the 2015 SPE/CSUR Unconventional Resources Conference. It is an interactive, educational

SoK: A Study of Using Hardware- assisted Isolated …webpages.eng.wayne.edu/~fy8421/17fa-csc6991/slides/2-SoK...SoK: A Study of Using Hardware-assisted Isolated Execu

SoK: A Study of Using Hardware- assisted Isolated …webpages.eng.wayne.edu/~fy8421/17fa-csc6991/slides/2-SoK...SoK: A Study of Using Hardware-assisted Isolated Execu

SoK: Secure Messaging

SoK: Secure Messaging

menu-4912235614713985043 · bijeli rum, liker od kokosa, sok od ananasa, Šlac sex on the beach vodka, liker od breskve, sok od ananasa, sok od brusnice gin tonic rose gin, tonic,

menu-4912235614713985043 · bijeli rum, liker od kokosa, sok od ananasa, Šlac sex on the beach vodka, liker od breskve, sok od ananasa, sok od brusnice gin tonic rose gin, tonic,

SoK: Decentralized Exchanges (DEX) with Automated Market ...

SoK: Decentralized Exchanges (DEX) with Automated Market ...

cSUR-UT Series: Library for Sustainable Urban Regeneration ...978-4-431-99267-7/1.pdf · cSUR-UT Series: Library for Sustainable Urban Regeneration By the process of urban development

cSUR-UT Series: Library for Sustainable Urban Regeneration ...978-4-431-99267-7/1.pdf · cSUR-UT Series: Library for Sustainable Urban Regeneration By the process of urban development

IM SOK 2019 Examiners' Report - um.edu.mt

IM SOK 2019 Examiners' Report - um.edu.mt

MANUSCRIPT 1 SoK: Applying Blockchain Technology in ...

MANUSCRIPT 1 SoK: Applying Blockchain Technology in ...

SoK: Secure Messaging - GitHub Pages

SoK: Secure Messaging - GitHub Pages

SOK FSCM 92Project Kickoff Meeting Final

SOK FSCM 92Project Kickoff Meeting Final

Khao Sok National Park, Thailand

Khao Sok National Park, Thailand

SoK: Security and Privacy in Machine Learning

SoK: Security and Privacy in Machine Learning

SOK P. Final IP MSW May25 2008

SOK P. Final IP MSW May25 2008

SOK CORPORATION - S-kanava.fi · – 3 – SOK Corporation’s revenue by segment SOK Corporation’s revenue in 2011 totalled EUR 11,280 million, up 21.6 per cent from the previous

SOK CORPORATION - S-kanava.fi · – 3 – SOK Corporation’s revenue by segment SOK Corporation’s revenue in 2011 totalled EUR 11,280 million, up 21.6 per cent from the previous

Sen Sok Post 2011

Sen Sok Post 2011

According to legend, the name batàna is connected to the ...Sok jabuka Sok jabuka Sok jabuka Sok jabuka 6,00 kn 12,00 kn 18,00 kn 30,00 kn 6,00 kn 12,00 kn ... Hefeweizen beer with

According to legend, the name batàna is connected to the ...Sok jabuka Sok jabuka Sok jabuka Sok jabuka 6,00 kn 12,00 kn 18,00 kn 30,00 kn 6,00 kn 12,00 kn ... Hefeweizen beer with

Original Sok Siphana Bar Association ASEAN 2015

Original Sok Siphana Bar Association ASEAN 2015

Burow,s garft

Burow,s garft

SoK: Machine Learning Governance

SoK: Machine Learning Governance