Taming Transactions: Towards Hardware-Assisted Control Flow Integrity Using Transactional Memory

  • Marius Muench
  • Fabio Pagani
  • Yan Shoshitaishvili
  • Christopher Kruegel
  • Giovanni Vigna
  • Davide Balzarotti
Conference paper

DOI: 10.1007/978-3-319-45719-2_2

Part of the Lecture Notes in Computer Science book series (LNCS, volume 9854)
Cite this paper as:
Muench M., Pagani F., Shoshitaishvili Y., Kruegel C., Vigna G., Balzarotti D. (2016) Taming Transactions: Towards Hardware-Assisted Control Flow Integrity Using Transactional Memory. In: Monrose F., Dacier M., Blanc G., Garcia-Alfaro J. (eds) Research in Attacks, Intrusions, and Defenses. RAID 2016. Lecture Notes in Computer Science, vol 9854. Springer, Cham

Abstract

Control Flow Integrity (CFI) is a promising defense technique against code-reuse attacks. While proposals to use hardware features to support CFI already exist, there is still a growing demand for an architectural CFI support on commodity hardware. To tackle this problem, in this paper we demonstrate that the Transactional Synchronization Extensions (TSX) recently introduced by Intel in the x86-64 instruction set can be used to support CFI.

The main idea of our approach is to map control flow transitions into transactions. This way, violations of the intended control flow graphs would then trigger transactional aborts, which constitutes the core of our TSX-based CFI solution. To prove the feasibility of our technique, we designed and implemented two coarse-grained CFI proof-of-concept implementations using the new TSX features. In particular, we show how hardware-supported transactions can be used to enforce both loose CFI (which does not need to extract the control flow graph in advance) and strict CFI (which requires pre-computed labels to achieve a better precision). All solutions are based on a compile-time instrumentation.

We evaluate the effectiveness and overhead of our implementations to demonstrate that a TSX-based implementation contains useful concepts for architectural control flow integrity support.

Keywords

Control flow integrity Transactional memory Intel\(^{\textregistered }\) TSX Binary hardening Software security 

Copyright information

© Springer International Publishing Switzerland 2016

Authors and Affiliations

  • Marius Muench
    • 1
  • Fabio Pagani
    • 1
  • Yan Shoshitaishvili
    • 2
  • Christopher Kruegel
    • 2
  • Giovanni Vigna
    • 2
  • Davide Balzarotti
    • 1
  1. 1.EurecomSophia AntipolisFrance
  2. 2.University of CaliforniaSanta BarbaraUSA

Personalised recommendations