Protecting C++ Dynamic Dispatch Through VTable Interleaving

23rd Annual Network and Distributed System Security Symposium, NDSS 2016

Volumn , Issue , 2016, Pages

  Bounov, Dimitar ^a   Kıcı, Rami Gökhan ^a   Lerner, Sorin ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

C++ (PROGRAMMING LANGUAGE); COMPUTER SOFTWARE;

BACKWARD COMPATIBLE; C PROGRAMS; CONTROL-FLOW; DYNAMIC DISPATCH; INTERLEAVINGS; METHOD TABLES; RUNTIMES; SET-MEMBERSHIP; STACK BUFFER OVERFLOWS; VTABLE HIJACKING;

PROGRAM DEBUGGING;

EID: 85025134274     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.14722/ndss.2016.23421     Document Type: Conference Paper

References (44)

1. “CWE-122.” Available from MITRE, CWE-ID CWE-122. [Online]. Available: https://cwe.mitre.org/data/definitions/122.html
2. “CVE-2012-0167.” Available from MITRE, CVE-ID CVE-2014-0160., 2011. [Online]. Available: https://cve.mitre.org/cgi-bin/cvename.cgi? name=CVE-2012-0167
3. M. Abadi, M. Budiu, Ú. Erlingsson, and J. Ligatti, “Control-flow integrity,” in CCS, 2005.
4. P. Akritidis, C. Cadar, C. Raiciu, M. Costa, and M. Castro, “Preventing memory error exploits with WIT,” in S&P, 2008, pp. 263-277.
5. M. Conti, S. Crane, L. Davi, M. Franz, P. Larsen, M. Negro, M. Qunaibit, and A.-r. Sadeghi, “Losing control: On the effectiveness of control-flow integrity under stack attacks,” In CCS, 2015.
6. C. Cowan, “Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks,” in USENIX Security, A. D. Rubin, Ed., 1998.
7. C. Cowan, S. Beattie, J. Johansen, and P. Wagle, “PointguardTM: Protecting pointers from buffer overflow vulnerabilities,” in USENIX Security, 2003.
8. S. Crane, S. Volckaert, F. Schuster, C. Liebchen, P. Larsen, L. Davi, A.-R. Sadeghi, T. Holz, B. D. Sutter, and M. Franz, “Its a trap: Table randomization and protection against function-reuse attacks,” In CCS, 2015.
9. L. Davi, A. Dmitrienko, M. Egele, T. Fischer, T. Holz, R. Hund, S. Nürnberger, and A. Sadeghi, “Mocfi: A framework to mitigate control-flow attacks on smartphones,” in NDSS, 2012.
10. C. Evans, “Exploiting 64-bit linux like a boss.” http://scarybeastsecurity. blogspot.com/search?q=Exploiting+64-bit+linux, 2013.
11. E. Göktas, E. Athanasopoulos, H. Bos, and G. Portokalidis, “Out of control: Overcoming control-flow integrity,” in In S&P, 2014.
12. Google, “Heap-use-after-free in WebCore (exploitable),” https://code. google.com/p/chromium/issues/detail?id=162835, 2012.
13. I. Haller, E. Göktas, E. Athanasopoulos, G. Portokalidis, and H. Bos, “Shrinkwrap: Vtable protection without loose ends,” in ACSAC, 2015, pp. 341-350.
14. M. InfoSecurity, “Pwn2own at cansecwest 2013,” https://labs. mwrinfosecurity.com/blog/2013/03/06/pwn2own-at-cansecwest-2013, 2013.
15. Intel, “Introduction to intel memory protection extensions,” https://software.intel.com/en-us/articles/introduction-to-intel-memoryprotection- extensions, 2013.
16. D. Jang, Z. Tatlock, and S. Lerner, “SafeDispatch: Securing C++ virtual calls from memory corruption attacks,” in NDSS, 2014.
17. V. Kuznetsov, L. Szekeres, M. Payer, G. Candea, R. Sekar, and D. Song, “Code-pointer integrity,” in OSDI, J. Flinn and H. Levy, Eds., 2014, pp. 147-163.
18. B. Lee, C. Song, T. Kim, and W. Lee, “Type casting verification: Stopping an emerging attack vector,” in USENIX Security, 2015.
19. LLVM Team, “The llvm compiler infrastructure project,” http://llvm. org/.
20. LLVM Team, “http://clang.llvm.org/docs/safestack.html,” http://clang.llvm.org/ docs/SafeStack.html, 2014.
21. LLVM Team, “Llvm link time optimization: Design and implementation,” http: //llvm.org/docs/LinkTimeOptimization.html, 2014.
22. LLVM Team, “Control flow integrity design documentation,” http://clang.llvm. org/docs/ControlFlowIntegrityDesign.html, 2015.
23. S. McCamant and G. Morrisett, “Evaluating SFI for a CISC architecture,” in In USENIX, 2006.
24. Microsoft, “Vulnerability in Internet Explorer could allow remote code execution,” http://technet.microsoft.com/en-us/security/advisory/ 961051, 2008.
25. Microsoft Visual Studio, “Image has safe exception handlers,” http: //msdn.microsoft.com/en-us/library/9a89h429%28v=vs.80%29.aspx, 2005.
26. V. Mohan, P. Larsen, S. Brunthaler, K. W. Hamlen, and M. Franz, “Opaque control-flow integrity,” in NDSS, 2015.
27. H. D. Moore, “Microsoft Internet Explorer data binding memory corruption,” http://packetstormsecurity.com/files/86162/ Microsoft-Internet-Explorer-Data-Binding-Memory-Corruption.html, 2010.
28. B. Niu and G. Tan, “Modular control-flow integrity,” in PLDI, 2014.
29. PaX Team, “Pax address space layout randomization (aslr),” http://pax. grsecurity.net/docs/aslr.txt, 2003.
30. A. Prakash, X. Hu, and H. Yin, “vfguard: Strict protection for virtual function calls in COTS C++ binaries,” in NDSS, 2015.
31. V. A. S. Andersen, “Data execution prevention: Changes to functionality in microsoft windows xp service pack 2, part 3: Memory protection technologies,” http://technet.microsoft.com/en-us/library/ bb457155.aspx, 2004.
32. F. Schuster, T. Tendyck, C. Liebchen, L. Davi, A. Sadeghi, and T. Holz, “Counterfeit object-oriented programming: On the difficulty of preventing code reuse attacks in C++ applications,” in S&P, 2015, pp. 745-762.
33. C. Small, “Misfit: A tool for constructing safe extensible C++ systems,” in USENIX Conference on Object-Oriented Technologies (COOTS), S. Vinoski, Ed., 1997, pp. 175-184.
34. Symantec, “Microsoft Internet Explorer virtual function table remote code execution vulnerability,” http://www.symantec.com/securityn response/vulnerability.jsp?bid=54951, 2012.
35. C. Tice, T. Roeder, P. Collingbourne, S. Checkoway, Ú. Erlingsson, L. Lozano, and G. Pike, “Enforcing forward-edge control-flow integrity in GCC & LLVM,” in NDSS, 2014.
36. N. Tuck, B. Calder, and G. Varghese, “Hardware and binary modification support for code pointer protection from buffer overflow,” in 37th Annual International Symposium on Microarchitecture (MICRO- 37, 2004, pp. 209-220.
37. VUPEN, “Exploitation of Mozilla Firefox use-after-free vulnerability,” http://www.vupen.com/blog/20120625.Advancedn Exploitationn of-Mozillan Firefoxn UaFn CVE-2012-0469.php, 2012.
38. R. Wahbe, S. Lucco, T. E. Anderson, and S. L. Graham, “Efficient software-based fault isolation,” in SOSP, 1993, pp. 203-216.
39. Z. Wang and X. Jiang, “Hypersafe: A lightweight approach to provide lifetime hypervisor control-flow integrity,” in S&P, 2010.
40. B. Yee, D. Sehr, G. Dardyk, J. B. Chen, R. Muth, T. Ormandy, S. Okasaka, N. Narula, and N. Fullagar, “Native client: A sandbox for portable, untrusted x86 native code,” in S&P, 2009, pp. 79-93.
41. B. Zeng, G. Tan, and G. Morrisett, “Combining control-flow integrity and static analysis for efficient and validated data sandboxing,” in CCS, 2011, pp. 29-40.
42. C. Zhang, C. Song, K. Z. Chen, Z. Chen, and D. Song, “Vtint: Protecting virtual function tables’ integrity,” in NDSS, 2015.
43. C. Zhang, T. Wei, Z. Chen, L. Duan, L. Szekeres, S. McCamant, D. Song, and W. Zou, “Practical control flow integrity and randomization for binary executables,” in S&P, 2013, pp. 559-573.
44. M. Zhang and R. Sekar, “Control flow integrity for COTS binaries,” in USENIX Security, 2013, pp. 337-352.