GRIFFIN: Guarding Control Flows Using Intel Processor Trace
GRIFFIN: Guarding Control Flows Using Intel Processor Trace
复制标题
DOI：
10.1145/3037697.3037716
复制
发表时间：
2017-04
期刊：
影响因子：
--
通讯作者：
Xinyang Ge;Weidong Cui;T. Jaeger
中科院分区：
文献类型：
--
作者：
Xinyang Ge;Weidong Cui;T. Jaeger
研究人员正在积极探索以执行控制流程完整性（CFI）的技术，该技术将程序执行限制为每个间接控制转移的预定义目标集，以防止代码恢复攻击。尽管硬件辅助的CFI执行可能具有优势在性能和软件仪器方面具有优势，但相比之下，当前硬件辅助的防御措施是不完整的（即不要执行所有控制转移），或者相比之下。我们发现，最近介绍了用于记录完整控制流轨迹的硬件功能，例如英特尔处理器跟踪（PT），提供了一个机会，可以探索硬件辅助CFI执行系统的高效和灵活性。尽管英特尔PT旨在通过设计一种并行化的方法来实施各种类型的CFI政策，但我们旨在帮助离线调试和失败诊断，但我们探索了其在线CFI执法对未修饰的二进制文件的有效性。我们已经在Linux 4.2内核中实现了一个名为Griffin的原型，该原型可以在包括Firefox浏览器及其jittle代码在内的各种软件上完成CFI执行。我们的实验表明，Griffin可以通过研究人员建议使用与仅软件仪器技术相当的性能来执行具有阴影堆栈的细粒度CFI策略。此外，我们发现替代记录方法为痕量处理提供了重大的性能改进，从而确定了进一步的硬件帮助的机会。
Researchers are actively exploring techniques to enforce control-flow integrity (CFI), which restricts program execution to a predefined set of targets for each indirect control transfer to prevent code-reuse attacks. While hardware-assisted CFI enforcement may have the potential for advantages in performance and flexibility over software instrumentation, current hardware-assisted defenses are either incomplete (i.e., do not enforce all control transfers) or less efficient in comparison. We find that the recent introduction of hardware features to log complete control-flow traces, such as Intel Processor Trace (PT), provides an opportunity to explore how efficient and flexible a hardware-assisted CFI enforcement system may become. While Intel PT was designed to aid in offline debugging and failure diagnosis, we explore its effectiveness for online CFI enforcement over unmodified binaries by designing a parallelized method for enforcing various types of CFI policies. We have implemented a prototype called GRIFFIN in the Linux 4.2 kernel that enables complete CFI enforcement over a variety of software, including the Firefox browser and its jitted code. Our experiments show that GRIFFIN can enforce fine-grained CFI policies with shadow stack as recommended by researchers at a performance that is comparable to software-only instrumentation techniques. In addition, we find that alternative logging approaches yield significant performance improvements for trace processing, identifying opportunities for further hardware assistance.