CPM: Masking Code Pointers to Prevent Code Injection Attacks

Authors:
Pieter Philippaerts;Yves Younan;Stijn Muylle;Frank Piessens;Sven Lachmund;Thomas Walter
Affiliations:
DistriNet Research Group, University of Leuven;DistriNet Research Group, University of Leuven;DistriNet Research Group, University of Leuven;DistriNet Research Group, University of Leuven;DOCOMO Euro-Labs;DOCOMO Euro-Labs
Venue:
ACM Transactions on Information and System Security (TISSEC)
Year:
2013

Citing 41
Cited 0

Adding run-time checking to the portable C compiler

Software—Practice & Experience
Efficient software-based fault isolation

SOSP '93 Proceedings of the fourteenth ACM symposium on Operating systems principles
Efficient detection of all pointer and array access errors

PLDI '94 Proceedings of the ACM SIGPLAN 1994 conference on Programming language design and implementation
Low-cost, concurrent checking of pointer and array accesses in C programs

Software—Practice & Experience
CCured: type-safe retrofitting of legacy code

POPL '02 Proceedings of the 29th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Ensuring code safety without runtime checks for real-time control systems

CASES '02 Proceedings of the 2002 international conference on Compilers, architecture, and synthesis for embedded systems
SPEC CPU2000: Measuring CPU Performance in the New Millennium

Computer
Cyclone: A Safe Dialect of C

ATEC '02 Proceedings of the General Track of the annual conference on USENIX Annual Technical Conference
Type-Assisted Dynamic Buffer Overflow Detection

Proceedings of the 11th USENIX Security Symposium
Secure Execution via Program Shepherding

Proceedings of the 11th USENIX Security Symposium
CCured in the real world

PLDI '03 Proceedings of the ACM SIGPLAN 2003 conference on Programming language design and implementation
Buffer overflow and format string overflow vulnerabilities

Software—Practice & Experience - Special issue: Security software
RAD: A Compile-Time Solution to Buffer Overflow Attacks

ICDCS '01 Proceedings of the The 21st International Conference on Distributed Computing Systems
Countering code-injection attacks with instruction-set randomization

Proceedings of the 10th ACM conference on Computer and communications security
Randomized instruction set emulation to disrupt binary code injection attacks

Proceedings of the 10th ACM conference on Computer and communications security
An efficient and backwards-compatible transformation to ensure memory safety of C programs

Proceedings of the 12th ACM SIGSOFT twelfth international symposium on Foundations of software engineering
On the effectiveness of address-space randomization

Proceedings of the 11th ACM conference on Computer and communications security
Run-time Detection of Heap-based Overflows

LISA '03 Proceedings of the 17th USENIX conference on System administration
Control-flow integrity

Proceedings of the 12th ACM conference on Computer and communications security
Extended Protection against Stack Smashing Attacks without Performance Loss

ACSAC '06 Proceedings of the 22nd Annual Computer Security Applications Conference
PointguardTM: protecting pointers from buffer overflow vulnerabilities

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
Address obfuscation: an efficient approach to combat a board range of memory error exploits

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
Efficient techniques for comprehensive protection from memory error exploits

SSYM'05 Proceedings of the 14th conference on USENIX Security Symposium - Volume 14
Evaluating SFI for a CISC architecture

USENIX-SS'06 Proceedings of the 15th conference on USENIX Security Symposium - Volume 15
StackGuard: automatic adaptive detection and prevention of buffer-overflow attacks

SSYM'98 Proceedings of the 7th conference on USENIX Security Symposium - Volume 7
The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)

Proceedings of the 14th ACM conference on Computer and communications security
Data Space Randomization

DIMVA '08 Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Righting Software

IEEE Software
Breaking the memory secrecy assumption

Proceedings of the Second European Workshop on System Security
Dynamic integrity measurement and attestation: towards defense against return-oriented programming attacks

Proceedings of the 2009 ACM workshop on Scalable trusted computing
DROP: Detecting Return-Oriented Programming Malicious Code

ICISS '09 Proceedings of the 5th International Conference on Information Systems Security
PAriCheck: an efficient pointer arithmetic checker for C programs

ASIACCS '10 Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security
Defeating return-oriented rootkits with "Return-Less" kernels

Proceedings of the 5th European conference on Computer systems
Fail-safe ANSI-C compiler: an approach to making C programs secure

ISSS'02 Proceedings of the 2002 Mext-NSF-JSPS international conference on Software security: theories and systems
Baggy bounds checking: an efficient and backwards-compatible defense against out-of-bounds errors

SSYM'09 Proceedings of the 18th conference on USENIX security symposium
G-Free: defeating return-oriented programming through gadget-less binaries

Proceedings of the 26th Annual Computer Security Applications Conference
ROPdefender: a detection tool to defend against return-oriented programming attacks

Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security
Code pointer masking: hardening applications against code injection attacks

DIMVA'11 Proceedings of the 8th international conference on Detection of intrusions and malware, and vulnerability assessment
Mitigating code-reuse attacks with control-flow locking

Proceedings of the 27th Annual Computer Security Applications Conference
BuBBle: a javascript engine level countermeasure against heap-spraying attacks

ESSoS'10 Proceedings of the Second international conference on Engineering Secure Software and Systems
Runtime countermeasures for code injection attacks against C and C++ programs

ACM Computing Surveys (CSUR)

Quantified Score

Hi-index	0.00

Visualization

Abstract

Code Pointer Masking (CPM) is a novel countermeasure against code injection attacks on native code. By enforcing the correct semantics of code pointers, CPM thwarts attacks that modify code pointers to divert the application’s control flow. It does not rely on secret values such as stack canaries and protects against attacks that are not addressed by state-of-the-art countermeasures of similar performance. This article reports on two prototype implementations on very distinct processor architectures, showing that the idea behind CPM is portable. The evaluation also shows that the overhead of using our countermeasure is very small and the security benefits are substantial.