Hacker News new | past | comments | ask | show | jobs | submit login

Microsoft has a much more sophisticated control flow integrity mechanism called control flow guard https://msdn.microsoft.com/en-us/library/windows/desktop/mt6....

LLVM also has an impressive set of CFI capabilities: https://clang.llvm.org/docs/ControlFlowIntegrity.html.

The proposal just sounds like higher entropy stack cookies.




I think the LLVM CFI options only apply to C++ programs?

Microsoft's CFG is cool, but works on the other end to this - by protecting CALL instructions instead of RET.

Stack cookies are similar, yes. This mechanism combines two ASLR-randomized values (the caller address and the stack address) to control program flow. Stack canaries use a constant random cookie per object file to detect stack smashing. Retguard raises the bar for successful ROP attacks, just as CFG raises the bar for function pointer corruption attacks.

Full disclosure, I am the author of the clang diff that kicked this off. The appeal of this mechanism is that it is cheap enough to apply in every function, pollutes the ROP gadget space with instructions that permute the next return address, and requires attackers to have more information in order to kick off ROP chains (the address where they are writing their ROP chain). I know about some of the other stuff people are working on (CPI seems promising), and look forward to turning those things on when possible. Meanwhile, this mitigation is cheap, localized inside every function, and doesn't require any program modification in the vast majority of situations (programs that inspect stack frames without consulting the unwind info may have problems), so is fairly easy to turn on everywhere.


Sorry, you are correct. I was actually thinking of clang's SafeStack (https://clang.llvm.org/docs/SafeStack.html) and Microsoft's Return Flow Guard (http://xlab.tencent.com/en/2016/11/02/return-flow-guard/). Both use shadow or alternate stacks.

Regarding cost, a few years back, I implemented a shadow stack system via static binary rewriting. The overhead was very low, 1-2%. SafeStack claims < 0.1%.


Ah, Return Flow Guard is cool - I did not know that MS had done that!

I like SafeStack, but was disappointed to learn about the limitations with shared libraries. Some SafeStack is better than no SafeStack though, and it can probably be turned on without too much effort.


I like it a lot, just the getPassName should include "Protector" instead of "Instructions"


Thanks! I see what you mean on getPassName - I missed it during revisions.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: