efficient cfi enforcement for c dynamic dispatch
play

Efficient CFI Enforcement for C++ Dynamic Dispatch Dimitar Bounov , - PowerPoint PPT Presentation

Feb 13, 2023 •383 likes •922 views

Efficient CFI Enforcement for C++ Dynamic Dispatch Dimitar Bounov , Rami Kici, Sorin Lerner UCSD Why A:ack Dynamic Dispatch? Valuable targets (e.g. browsers) 11M LOC ~30M LOC 7M LOC ?M LOC C/C++ C/C++ C/C++ C/C++ Why A:ack Dynamic

  1. Efficient CFI Enforcement for C++ Dynamic Dispatch Dimitar Bounov , Rami Kici, Sorin Lerner UCSD

  2. Why A:ack Dynamic Dispatch? • Valuable targets (e.g. browsers) 11M LOC ~30M LOC 7M LOC ?M LOC C/C++ C/C++ C/C++ C/C++

  3. Why A:ack Dynamic Dispatch? • Valuable targets (e.g. browsers) • Prevalence of Dynamic Dispatch • 91.8 % of Indirect Calls in Chrome [ Tice ’14 ]

  4. Why A:ack Dynamic Dispatch? • Valuable targets (e.g. browsers) • Prevalence of Dynamic Dispatch • Exploited in the wild

  5. Prior Work and ContribuAon • Prior defenses vfGuard [Prakash’15], VTInt [Zhao’15], SafeDispatch [Jang’14], VTV [Tice’14] ... • Our contribu^on: novel VTable layouts • Lower overhead & no profiling

  6. Example class A { A Afoo() virtual void foo(); } class B : public A { Bfoo() Afoo() B C virtual void foo(); Bbar() Cbaz() virtual void bar(); } class C : public A { D Dfoo() virtual void baz(); Bbar() } Dboo() class D : public B { virtual void foo(); virtual void boo(); }

  7. C++ Memory Layout A Afoo() Bfoo() Afoo() B C Bbar() Cbaz() D Dfoo() Bbar() Dboo()

  8. C++ Memory Layout Object Instance Virtual Table C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo

  9. Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) A* a = (A*) … fn_ptr = (*(vptr + 0)) a->foo() (*fn_ptr)(); Method Index

  10. ExploiAng Dynamic Dispatch exec C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  11. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  12. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) assert (vptr ∈ { A, B, C, D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  13. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo Read-Only vptr = (*a) assert (vptr ∈ { A, B, C, D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Inline Constant

  14. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) assert (vptr ∈ { A, B, C, D }) How to implement safety fn_ptr = (*(vptr + 0)) check efficiently? (*fn_ptr)();

  15. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) Non-regular values assert (vptr ∈ { 0x0, 0x8, 0x18, 0x28 }) fn_ptr = (*(vptr + 0)) Hard to test (*fn_ptr)();

  16. ProtecAng Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Key idea 1: Bbar Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Cbaz Order and Pad VTables … … Dfoo D Dfoo() Bbar Bbar() Dboo() Dboo vptr = (*a) Non-regular values assert (vptr ∈ { 0x0, 0x8, 0x18, 0x28 }) fn_ptr = (*(vptr + 0)) Hard to test (*fn_ptr)();

  17. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo Cbaz 1. Traverse in pre-order: A, B, D, C 2. For each class layout vtable and pad

  18. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz 1. Traverse in pre-order: A, B, D, C assert (vptr ∈ { A,B,C,D }) fn_ptr = (*(vptr + 0)) 2. For each class layout vtable and pad (*fn_ptr)();

  19. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz assert (vptr ∈ { A,B,C,D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  20. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz assert (vptr ∈ { 0x0, 0x20, 0x40, 0x60 }) Regular fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Address Points

  21. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz assert (vptr ∈ { 0x0, 0x20, 0x40, 0x60 }) fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Efficient Check

  22. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*a) Cbaz assert (0x0 ≤ vptr ≤ 0x60 ∧ vptr % 0x20 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Efficient Check

  23. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*b) Cbaz assert (vptr ∈ { B, D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  24. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*b) Cbaz assert (vptr ∈ { 0x20, 0x40 }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  25. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo vptr = (*b) Cbaz assert (0x20 ≤ vptr ≤ 0x40 ∧ vptr % 0x20 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  26. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo … … Bbar D Dfoo() Dboo Bbar() 8 B Dboo() Afoo Cbaz Wasteful Extra Padding

  27. Ordered Memory Layout Afoo C A A 24 B Afoo() … … Bfoo Bbar Key idea 2: Bfoo() Afoo() B C 16 B Bbar() Cbaz() B D Dfoo Interleave VTables … … Bbar D Dfoo() Dboo Bbar() 16 B Dboo() Afoo Cbaz Wasteful Extra Padding

  28. Interleaved Memory Layout C A A Afoo() … … Bfoo() Afoo() B C Bbar() Cbaz() B D … … D Dfoo() Bbar() Dboo() 1. Traverse in pre-order: A, B, D, C 2. Layout each method

  29. Interleaved Memory Layout C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz 1. Traverse in pre-order: A, B, D, C 2. Layout each method

  30. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*a) 1. Traverse in pre-order: A, B, D, C assert (vptr ∈ { A,B,C,D }) fn_ptr = (*(vptr + 0)) 2. Layout each method (*fn_ptr)();

  31. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*a) assert (vptr ∈ { A,B,C,D }) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  32. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*a) assert (vptr ∈ { 0x0, 0x8, 0x10, 0x18 }) Address Points fn_ptr = (*(vptr + 0)) (*fn_ptr)(); Consecu^ve Addrs.

  33. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*a) assert (0x0 ≤ vptr ≤ 0x18 ∧ vptr % 0x8 = 0) fn_ptr = (*(vptr + 0)) Same Check (*fn_ptr)(); Different range & alignment

  34. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*b) assert (0x0 ≤ vptr ≤ 0x18 ∧ vptr % 0x8 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  35. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*b) assert (0x8 ≤ vptr ≤ 0x10 ∧ vptr % 0x8 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

  36. Interleaved Dynamic Dispatch C A A Afoo() Afoo … … Bfoo Dfoo Bfoo() Afoo() B C Bbar() Cbaz() Afoo B D Bbar … … Bbar D Dfoo() Dboo Bbar() Dboo() Cbaz vptr = (*b) assert (0x8 ≤ vptr ≤ 0x10 ∧ vptr % 0x8 = 0) fn_ptr = (*(vptr + 0)) (*fn_ptr)();

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

CSE 341 Programming Languages Dynamic Dispatch vs. Closures OOP vs. Functional Decomposition

CSE 341 Programming Languages Dynamic Dispatch vs. Closures OOP vs. Functional Decomposition

CSE 341 Programming Languages Dynamic Dispatch vs. Closures OOP vs. Functional Decomposition Wrapping Up Zach Tatlock Spring 2014 Dynamic dispatch Dynamic dispatch Also known as late binding or virtual methods Call self.m2() in method

935 views • 55 slides
Redundancy-free Residual Dispatch Using Ordered Binary Decision Diagrams for Efficient Dispatch

Redundancy-free Residual Dispatch Using Ordered Binary Decision Diagrams for Efficient Dispatch

Formula-based Dispatch BDD-based Dispatch Assessment Redundancy-free Residual Dispatch Using Ordered Binary Decision Diagrams for Efficient Dispatch Andreas Sewe Christoph Bockisch Mira Mezini Seventh International Workshop on Foundations

408 views • 39 slides
ENFORCEMENT TRAFFIC DIVISION Direct Line : (619) 522-2446 Dispatch (Non-Emergency) : (619)

ENFORCEMENT TRAFFIC DIVISION Direct Line : (619) 522-2446 Dispatch (Non-Emergency) : (619)

MOTORCYCLE ENFORCEMENT TRAFFIC DIVISION Direct Line : (619) 522-2446 Dispatch (Non-Emergency) : (619) 522-7350 Sergeant Shawn ONeill 700 Orange Avenue, Coronado CA 92118 1 The Coronado Police Department Traffic Unit Our goal is to

546 views • 11 slides
Context Threading: A flexible and efficient dispatch technique for virtual machine interpreters

Context Threading: A flexible and efficient dispatch technique for virtual machine interpreters

Context Threading: A flexible and efficient dispatch technique for virtual machine interpreters Marc Berndl Benjamin Vitale Mathew Zaleski Angela Demke Brown Research supported by IBM CAS, NSERC, CITO 1 Interpreter performance Why not

912 views • 25 slides
Objectives Inheritance Polymorphism Dynamic dispatch Sep 11, 2020 Sprenkle - CSCI209 1

Objectives Inheritance Polymorphism Dynamic dispatch Sep 11, 2020 Sprenkle - CSCI209 1

10/7/20 Objectives Inheritance Polymorphism Dynamic dispatch Sep 11, 2020 Sprenkle - CSCI209 1 1 Review We would like to return a private variable from a public method Why could that be a problem? How should we implement

225 views • 21 slides
There's More Than One Way To Dispatch It

There's More Than One Way To Dispatch It

There's More Than One Way To Dispatch It 2009 There's More Than One Way To Dispatch It Topological sorting of a directed acyclic graph

496 views • 36 slides
No! In fact, dynamic enforcement is as secure as Denning-style enforcement Trick: termination

No! In fact, dynamic enforcement is as secure as Denning-style enforcement Trick: termination

No! In fact, dynamic enforcement is as secure as Denning-style enforcement Trick: termination public:=0 channel Denning-style if secret enforcement termination-insensitive No assignments to public Monitor blocks variables

277 views • 11 slides
METRO WEST AMBULANCE DISPATCH CENTER Presented by Kristen Hoover & Larry Boxman DISPATCH

METRO WEST AMBULANCE DISPATCH CENTER Presented by Kristen Hoover & Larry Boxman DISPATCH

METRO WEST AMBULANCE DISPATCH CENTER Presented by Kristen Hoover & Larry Boxman DISPATCH CENTER 8 dispatch stations 2 supervisor consoles 5 call taker stations Dispatch Center Average of 1,200 phone calls in/out daily

392 views • 10 slides
Late Binding; OOP as a Racket Pattern Today Dynamic dispatch aka late binding aka virtual method

Late Binding; OOP as a Racket Pattern Today Dynamic dispatch aka late binding aka virtual method

Late Binding; OOP as a Racket Pattern Today Dynamic dispatch aka late binding aka virtual method calls Call to self.m2() in method m1 defined in class C can resolve to a method m2 defined in a subclass of C Most unique characteristic of

652 views • 11 slides
DSM Dispatch Conditions p Dr Richard Tooth 22 November 2012 2 Introduction Proposals in

DSM Dispatch Conditions p Dr Richard Tooth 22 November 2012 2 Introduction Proposals in

DSM Dispatch Conditions p Dr Richard Tooth 22 November 2012 2 Introduction Proposals in place affecting the dispatch of DSM Most notably, shift to unlimited hours of dispatch per year Also of relevance Minimum notice

500 views • 17 slides
Dynamic Policy Enforcement Dynamic Policy Enforcement in a Networked Environment in a Networked

Dynamic Policy Enforcement Dynamic Policy Enforcement in a Networked Environment in a Networked

Dynamic Policy Enforcement Dynamic Policy Enforcement in a Networked Environment in a Networked Environment Brandon Pollet Brandon Pollet Enterprise Security Group Enterprise Security Group Center for Information Security Center for

671 views • 28 slides
j i u a l The Unreasonable Effectiveness of Multiple Dispatch Stefan Karpinski Multiple

j i u a l The Unreasonable Effectiveness of Multiple Dispatch Stefan Karpinski Multiple

j i u a l The Unreasonable Effectiveness of Multiple Dispatch Stefan Karpinski Multiple Dispatch? dispatch dispatched on selection syntax degree arguments power none f(x, y) { } O(1) single x.f(y) {x} O(|X|) multiple

646 views • 30 slides
There's More Than One Way To Dispatch It Jonathan Worthington Nordic Perl Workshop 2009 There's

There's More Than One Way To Dispatch It Jonathan Worthington Nordic Perl Workshop 2009 There's

There's More Than One Way To Dispatch It Jonathan Worthington Nordic Perl Workshop 2009 There's More Than One Way To Dispatch It Single Dispatch We're used to writing subroutines with a name # Perl 6 sub taking one parameter $name sub

690 views • 43 slides
Costs 26 th May 2011 Agenda Introduction Overview of Dispatch Balancing Costs (30 mins)

Costs 26 th May 2011 Agenda Introduction Overview of Dispatch Balancing Costs (30 mins)

Operations Seminar Managing Dispatch Balancing Costs 26 th May 2011 Agenda Introduction Overview of Dispatch Balancing Costs (30 mins) Ongoing Management of Dispatch Balancing Costs (15 mins) Forecasting Dispatch Balancing Costs

1.15k views • 87 slides
in Hungary Enforcement procedure Procedure after Ordering enforcement enforcement order

in Hungary Enforcement procedure Procedure after Ordering enforcement enforcement order

Monitoring of enforcement in Hungary Enforcement procedure Procedure after Ordering enforcement enforcement order Ordering enforcement Authorities court notary public Enforcement order certificate of enforcement

540 views • 12 slides
Outline ROS Basics Plan Execution Very Simple Dispatch Very Simple Temporal

Outline ROS Basics Plan Execution Very Simple Dispatch Very Simple Temporal

Outline ROS Basics Plan Execution Very Simple Dispatch Very Simple Temporal Dispatch Conditional Dispatch Temporal and Conditional Dispatch together Dispatching More than a Single Plan Hierarchical and

1.69k views • 99 slides
Side-channels Deian Stefan Slides adopted from Stefan Savage, Nadia Heninger, Sunjay Cauligi

Side-channels Deian Stefan Slides adopted from Stefan Savage, Nadia Heninger, Sunjay Cauligi

CSE 127: Computer Security Side-channels Deian Stefan Slides adopted from Stefan Savage, Nadia Heninger, Sunjay Cauligi Context Isolation is key to building secure systems Used to implement privilege separation, least privilege and

1.21k views • 103 slides
Solving Regularized Total Least Squares Problems Based on Eigensolvers Heinrich Voss

Solving Regularized Total Least Squares Problems Based on Eigensolvers Heinrich Voss

Solving Regularized Total Least Squares Problems Based on Eigensolvers Heinrich Voss voss@tu-harburg.de Hamburg University of Technology Institute of Numerical Simulation Joint work with Jrg Lampe TUHH Heinrich Voss Total Least Squares

994 views • 56 slides
An algorithm for the least-squares solution of rank-deficient linear systems G. Rodriguez

An algorithm for the least-squares solution of rank-deficient linear systems G. Rodriguez

An algorithm for the least-squares solution of rank-deficient linear systems G. Rodriguez Dipartimento di Matematica e Informatica, Universit` a di Cagliari viale Merello 92, 09123 Cagliari, Italy in collab. with Antonio Aric` o (Dip. di

849 views • 49 slides
a 11 a 1 n . . ... . . A = . . a n 1 a nn

a 11 a 1 n . . ... . . A = . . a n 1 a nn

Lesson 16 L EAST S QUARES Let a 11 a 1 n . . ... . . A = . . a n 1 a nn be an n n matrix with complex entries (i.e., A C n n ) It is helpful to view A as a row-vector whose

720 views • 50 slides
The ALP miracle collaboration with F. Takahashi & W. Yin Ryuji Daido Tohoku Univ. @PPP2017

The ALP miracle collaboration with F. Takahashi & W. Yin Ryuji Daido Tohoku Univ. @PPP2017

The ALP miracle collaboration with F. Takahashi & W. Yin Ryuji Daido Tohoku Univ. @PPP2017 1702.03284 JCAP05(2017)044 There are two unknown degree of freedom in the CDM. (except for the origin of .) 1. Introduction

579 views • 25 slides
Modelling and Reasoning about State Nick Benton Microsoft Research, Cambridge k Introduction

Modelling and Reasoning about State Nick Benton Microsoft Research, Cambridge k Introduction

Modelling and Reasoning about State Nick Benton Microsoft Research, Cambridge k Introduction Most programming languages are imperative As time progresses, execution steps read and destructively update the state This reflects the

1.34k views • 79 slides
Dialogue Modelling, Language Processing Dynamics and Linguistic Knowledge Eleni

Dialogue Modelling, Language Processing Dynamics and Linguistic Knowledge Eleni

Linguistic knowledge: the relevance of dialogue Dialogue Modelling: new challenge, new data, new solutions Dynamic Syntax: incremental structure/content growth Grammar design Dialogue Modelling, Language Processing Dynamics and Linguistic

1.45k views • 120 slides
Machine Learning for Ontology Mining: Perspectives and Issues Claudia dAmato Department of

Machine Learning for Ontology Mining: Perspectives and Issues Claudia dAmato Department of

Machine Learning for Ontology Mining: Perspectives and Issues Claudia dAmato Department of Computer Science University of Bari OWLED 2014 Riva del Garda, October 18, 2014 Contents Introduction & Motivation 1 Basics 2 Instance

819 views • 70 slides

More recommend