ShadowStack: A new approach for secure program execution

Highlights

• Recently, computer systems have been experiencing an increasing wave of attacks.

• This implies in loss of privacy, financial and national security damages.

• Integrity Checking (IC) emerged as a possible solution to protect computer systems.

• ShadowStack is a promising IC technique based on a hardware-implemented watchdog.

Abstract

In recent years, computer systems belonging to large companies, governments as well as personal computers have been experiencing an increasing wave of attacks that disrupt their normal operation or leak sensitive data. This implies in loss of privacy, financial and national security damages. In this context, “computer security” is no longer an afterthought. Dynamic integrity checking has emerged as a possible solution to protect computer systems by thwarting various attacks. In this context, this paper presents ShadowStack, a new dynamic integrity checking technique based on a watchdog implemented in hardware. The watchdog observes specific instructions in the code being executed through the processor pipeline, compares them against reference values generated at runtime and in the event of detecting a tentative of intrusion, the pipeline is stalled and the instructions are not allowed to commit by flushing them from the pipe. The attack type is stack smashing buffer overflow. This threatening type is by far the most common found in the literature. Experimental results obtained throughout simulations demonstrate the technique's efficiency and the corresponding overheads incurred by the use of the proposed approach.

Introduction

The need to include security mechanisms in electronic devices has dramatically grown with the widespread use of such devices in our daily life. With the increasing interconnectivity among devices, attackers can now launch attacks remotely. Such attacks arrive as data over a regular communication channel and, once resident in the program memory, they trigger a pre-existing software flaw and transfer control to the attacker's malicious code. Software vulnerabilities have been the main cause of computer security incidents. Among these, buffer overflows are perhaps the most widely exploited type of vulnerability, accounting for approximately half the CERT advisories in recent years [1].

In this scenario, this paper presents a new hardware-based approach to detect stack smashing buffer overflow attack. This approach does not need application code recompilation or use of any kind of software (e.g., an OS) to manage memory usage. According to preliminary implementations, this approach guarantees 100% attack detection, while resulting in negligible area overhead and zero performance degradation (since the watchdog is fully independent from the processor and performs in parallel to the code execution).