论文标题
自动化的多构造发现CFI耐药代码小工具的发现
Automated Multi-Architectural Discovery of CFI-Resistant Code Gadgets
论文作者
论文摘要
内存腐败漏洞仍然是软件系统的严重威胁。为了阻止这种漏洞的剥削，过去曾提出过许多不同种类的防御能力。最突出的是，控制流的完整性（CFI）最近受到了很多关注。发表了一些提出的提案，该提案采用了低性能开销的粗粒策略。但是，正如最近的攻击所表明的那样，他们的安全仍然值得怀疑。 为了简化给定CFI实施的评估，我们引入了一个框架，以发现符合粗粒度CFI策略的代码重复攻击的代码小工具。为此，将二进制代码以独立于架构的方式提取并转换为符号表示。此外，验证了代码小工具以为安全研究人员提供所需的功能。我们表明，与其他代码小工具发现工具相比，我们的框架找到了更多与CFI兼容的小工具。此外，我们证明，我们的框架也可以发现绕过ARM架构上的CFI解决方案所需的代码小工具。
Memory corruption vulnerabilities are still a severe threat for software systems. To thwart the exploitation of such vulnerabilities, many different kinds of defenses have been proposed in the past. Most prominently, Control-Flow Integrity (CFI) has received a lot of attention recently. Several proposals were published that apply coarse-grained policies with a low performance overhead. However, their security remains questionable as recent attacks have shown. To ease the assessment of a given CFI implementation, we introduce a framework to discover code gadgets for code-reuse attacks that conform to coarse-grained CFI policies. For this purpose, binary code is extracted and transformed to a symbolic representation in an architecture-independent manner. Additionally, code gadgets are verified to provide the needed functionality for a security researcher. We show that our framework finds more CFI-compatible gadgets compared to other code gadget discovery tools. Furthermore, we demonstrate that code gadgets needed to bypass CFI solutions on the ARM architecture can be discovered by our framework as well.
