Fast Out-of-Band Data Integrity Monitor to Mitigate Memory Corruption Attacks

Abstract

Memory corruption is a root cause of software attacks. Existing defense mechanisms (e.g., DEP, ASLR, CFI, CPI/CPS, and DFI) either offer limited security guarantees or incur high performance overhead. In this paper, we designed and developed a fast out-of-band (OOB) integrity monitor dubbed FastDIM to protect both applications and kernels against memory corruption attacks with less overhead. With FastDIM, a program in question is statically hardened by a compiler module. After that, the integrity of sensitive program data such as control-flow transfers (e.g., code pointers) and security relevant non-control data (e.g., encryption keys) are automatically protected by a monitor at run time. The key differences between FastDIM and related work are in the following aspects: 1) FastDIM offers an OOB monitor that protects the programs independently rather than letting the protected programs verify themselves using inlined reference monitor (IRM); 2) FastDIM extends the concept of shadow stacks originally proposed in CFI to protect not only return addresses but also other sensitive data such as function pointers, vtable pointers, and user-annotated sensitive non-control data. Thus, the protection of FastDIM is beyond control-flow data; 3) FastDIM provides a fast communication mechanism between programs and the monitor, so that the integrity checks are performed efficiently without context switch; and 4) for a better scalability and compatibility, FastDIM does not rely on LTO and Cross-DSO to support applications with dynamically linked libraries. We implemented a Kernel version and a TrustZone version of FastDIM to protect both user programs and Linux/Android kernels. The evaluation results show that the average overhead of FastDIM is 4.4% on SPEC CPU2017 C/C++ benchmarks and around 3% on AnTuTu benchmarks.