더 나은 세상

Enforcing forward edge control flow integrity in GCC & LLVM 본문

논문리뷰

Enforcing forward edge control flow integrity in GCC & LLVM

leemark 2019. 3. 27. 21:53

Usenix Security symposium 14 (Security 14)

1. introduction

Two practical CFI machanism : GCC, LLVM(Dynamic)

practical을 굉장히 강조(할만하다)

overhead : 1~8.7%, 95~99% protection

2. Attacks and Copiler-based Defences

3개의 compiler based machanism소개

 - 1 : heap에 있는 control transfer data integrity

 - 2 : function pointer target이나 vtable에 대한 접근을 제한

 - 3 : runtime analysis가 CFI violation을 찾아냄(미리)

GCC, LLVM 모두  CFG를 read only로 둠, fast integrity check를 위해 machine code추가, 어떤 부분에선 integrity check를 위해 코드 전환, error handler call, important exception을 위해 runtime library routine이용한다.

stack은 많은 툴이 있으므로 heap region위주로 보호, trusty compiler 가정 - practical해야하므로

related work을 보면서 XFI를 읽어보고 싶어졌다.

3. VTV : Virtual Table Verification

4. IFCC : Indirect Function Call Check

5. FSan : Indirect Call Check Analysis

6. Security Analysis

7. Performance Measurements and Results

8. Conclusion

Q : Chromium?

'논문리뷰' 카테고리의 다른 글

KCoFI : Complete Control Flow Integrity for Commodity Operating System Kernels (Oakland 14)  (0) 2019.03.29
[논문리뷰]AddressSanitizer: A Fast Address Sanity checker  (0) 2018.09.29
[논문리뷰]Milkomeda: Safeguarding the Mobile GPU Interface Using WebGL’s Security Checks  (0) 2018.09.29
A study of Overflow Vulnerabilities on GPUs  (0) 2018.07.02
Buffer overflow vulnerabilities in CUDA: a preliminary analysis  (0) 2018.07.02
'논문리뷰' Related Articles more