SoK: Shining Light on Shadow Stacks Nathan Burow , Xinping Zhang, - - PowerPoint PPT Presentation

▶
sok shining light on shadow stacks
SMART_READER_LITE
LIVE PREVIEW

SoK: Shining Light on Shadow Stacks Nathan Burow , Xinping Zhang, - - PowerPoint PPT Presentation

Sep 22, 2023 221 likes •576 views

SoK: Shining Light on Shadow Stacks Nathan Burow , Xinping Zhang, Mathias Payer Control-Flow Hijacking (CFH) Microsoft: 70% of bugs are memory corruptions Control and Data Planes are interleaved Memory corruption Control-Flow

slide-1
SLIDE 1

SoK: Shining Light on Shadow Stacks

Nathan Burow, Xinping Zhang, Mathias Payer

slide-2
SLIDE 2

Control-Flow Hijacking (CFH)

  • Microsoft: 70% of bugs are memory corruptions
  • Control and Data Planes are interleaved
  • Memory corruption à Control-Flow Hijacking

2

Data Code Pointer

slide-3
SLIDE 3

Control-Flow Hijacking (CFH)

  • Microsoft: 70% of bugs are memory corruptions
  • Control and Data Planes are interleaved
  • Memory corruption à Control-Flow Hijacking

3

Data Code Pointer

slide-4
SLIDE 4

Forward Edge

  • Function pointers; virtual calls
  • Control-Flow Integrity (CFI) – statically calculates target sets

4

slide-5
SLIDE 5

Forward Edge

  • Function pointers; virtual calls
  • Control-Flow Integrity (CFI) – statically calculates target sets

5

fptr()

slide-6
SLIDE 6

Forward Edge

  • Function pointers; virtual calls
  • Control-Flow Integrity (CFI) – statically calculates target sets

6

fptr()

slide-7
SLIDE 7

Backward Edge

  • Return Instructions
  • Does CFI style analysis work?

7

slide-8
SLIDE 8

Backward Edge

  • Return Instructions
  • Does CFI style analysis work?

8

ret

slide-9
SLIDE 9

Backward Edge

  • Return Instructions
  • Does CFI style analysis work?

9

NO

slide-10
SLIDE 10

Backward Edge

  • CFI style target sets include every call site for the function
  • Target sets are too large to provide meaningful protection

10

Security requires integrity for return addresses!

slide-11
SLIDE 11

CFH Mitigation Today

  • Seminal CFI paper by Abadi et. al. called for shadow stack
  • See Burow et al CSUR 2017[1]
  • Deployed versions by Microsoft / Google only cover forward edge

11

No equally strong defense for backward edge!

[1] Burow et. al. “Control-flow integrity: Precision, security, and performance.” CSUR 2017.

slide-12
SLIDE 12

Shadow Stacks

  • Separate return addresses from data plane
  • Provide integrity protection for return addresses
  • Performant and highly compatible

12

Need to deploy Shadow Stack with CFI!

slide-13
SLIDE 13

Control-Flow Hijacking Illustrated

Program Stack

Return Address Stack Canary

Array Pointer

13

slide-14
SLIDE 14

Control-Flow Hijacking Illustrated

Program Stack

Return Address Stack Canary

Array Pointer

14

slide-15
SLIDE 15

Control-Flow Hijacking Illustrated

Program Stack

Return Address Stack Canary

Array Pointer

15

slide-16
SLIDE 16

Control-Flow Hijacking Illustrated

Program Stack

Return Address Stack Canary

Array Pointer

16

slide-17
SLIDE 17

Control-Flow Hijacking Illustrated

Program Stack

Return Address Stack Canary

Array Pointer

17

slide-18
SLIDE 18

Control-Flow Hijacking Illustrated

Program Stack

ROP Pointer Stack Canary

Array Pointer

18

slide-19
SLIDE 19

What is a Shadow Stack?

⋮

foo() bar()

Return Address Return Address

Program Stack Shadow Stack

Return Address

⋮

Return Address

19

slide-20
SLIDE 20

Shadow Stack Defense

Program Stack

ROP Pointer Stack Canary

Array Pointer

Shadow RA

Shadow Stack

20

slide-21
SLIDE 21

Shadow Stack Defense

Program Stack

ROP Pointer Stack Canary

Array Pointer

Shadow RA

Shadow Stack

21

slide-22
SLIDE 22

Shadow Stack Defense

Program Stack

ROP Pointer Stack Canary

Array Pointer

Shadow RA

Shadow Stack

❌

22

slide-23
SLIDE 23

Advantages of Shadow Stacks

  • Know at runtime what function you were called from
  • Dynamic defense – does NOT rely on static analysis
  • Separates code and data planes for backward edges

23

Fully precise backward edge protection!

slide-24
SLIDE 24

Shadow Stack Design Space

24

[1] T. H. Dang, P. Maniatis, and D. Wagner, “The performance cost of shadow stacks and stack canaries,” in AsiaCCS ’15 [2] T.-c. Chiueh and F.-H. Hsu, “Rad: A compile-time solution to buffer overflow attacks,” in ICDCS ’01 [3] L. Davi, A.-R. Sadeghi, and M. Winandy, “Ropdefender: A detection tool to defend against return-oriented programming attacks,” in AsiaCCS’11

[1] [2],[3]

Stack Stack Shadow Stack 8MB 8MB constant Direct Mapping Stack Stack Shadow Stack 8MB Indirect Mapping Grows on demand

slide-25
SLIDE 25

Recommended Shadow Stack

  • Indirect mapping
  • Use a general purpose register for shadow stack pointer

25

Optimal performance and high compatibility!

slide-26
SLIDE 26

Recommended Mapping

  • Indirect Mapping
  • As performant as direct mapping
  • Minimizes memory overhead

26

Fastest mapping has lowest memory overhead!

slide-27
SLIDE 27

Recommended Encoding

  • Use general purpose (GP) register for shadow stack pointer
  • Does not increase register pressure
  • Significant optimization for shadow stacks

27

Dedicating a register to the shadow stack pointer is an effective optimization!

slide-28
SLIDE 28

Compatibility of Recommended Shadow Stack

  • Threading: fully supported. GP registers are thread local
  • Stack Unwinding: provide instrumented setjmp / longjmp
  • Unprotected Code: save and restore shadow stack pointer

28

Support all applications and incremental deployment!

slide-29
SLIDE 29

Intra-Process Memory Isolation

  • Shadow Stack splits code and data planes
  • Enables integrity enforcement by isolating return addresses

29

Shadow Stacks enable code pointer integrity for return addresses!

slide-30
SLIDE 30

Intra-Process Memory Isolation

  • Software based randomization defense are defeasible
  • Intel MPX uses bounds checks for isolation, moderate performance
  • Intel MPK changes permissions of pages, slow performance

30

None of these are fully satisfactory. Tagged architectures are a promising new approach.

slide-31
SLIDE 31

SPEC CPU2006 Performance Evaluation

31

Shadow Stack Geometric Mean Max Min

Direct 5.78% 38.68% 0.00% Recommended 3.65% 9.70% 0.00%

slide-32
SLIDE 32

SPEC CPU2006 Performance Evaluation

32

Shadow Stack Geometric Mean Max Min

Direct 5.78% 38.68% 0.00% Recommended 3.65% 9.70% 0.00%

slide-33
SLIDE 33

SPEC CPU2006 – Integrity Enforcement

33

Integrity Scheme Geometric Mean Max Min Randomization 4.31% 13.68% 0.00% MPX 12.12% 33.02% 2.47% MPK 61.18% 419.81% 0.00%

slide-34
SLIDE 34

Conclusion

  • Stack remains vulnerable to code reuse attacks
  • Need to separate return addresses from data plane
  • Recommend a compact, register based shadow stack for deployment

34

Shadow Stacks + CFI = practical CFH mitigation

https://github.com/HexHive/ShadowStack