| Title | Bypassing memory safety mechanisms through speculative control flow hijacks |
| Publication Type | Conference Paper |
| Year of Publication | 2021 |
| Authors | Mambretti, Andrea, Sandulescu, Alexandra, Sorniotti, Alessandro, Robertson, William, Kirda, Engin, Kurmus, Anil |
| Conference Name | 2021 IEEE European Symposium on Security and Privacy (EuroS P) |
| Keywords | Buffer overflows, composability, Computer bugs, Force, hardware security, human factors, Memory Safety Mechanisms, operating system security, process control, Programming, pubcrawl, Resiliency, rop attacks, Runtime, Scalability, side channels, Software, Speculative ROP, Transient Execution |
| Abstract | The prevalence of memory corruption bugs in the past decades resulted in numerous defenses, such as stack canaries, control flow integrity (CFI), and memory-safe languages. These defenses can prevent entire classes of vulnerabilities, and help increase the security posture of a program. In this paper, we show that memory corruption defenses can be bypassed using speculative execution attacks. We study the cases of stack protectors, CFI, and bounds checks in Go, demonstrating under which conditions they can be bypassed by a form of speculative control flow hijack, relying on speculative or architectural overwrites of control flow data. Information is leaked by redirecting the speculative control flow of the victim to a gadget accessing secret data and acting as a side channel send. We also demonstrate, for the first time, that this can be achieved by stitching together multiple gadgets, in a speculative return-oriented programming attack. We discuss and implement software mitigations, showing moderate performance impact. |
| DOI | 10.1109/EuroSP51992.2021.00048 |
| Citation Key | mambretti_bypassing_2021 |
Bypassing memory safety mechanisms through speculative control flow hijacks