SegmentShield: Exploiting Segmentation Hardware for Protecting against Buffer Overflow Attacks
SegmentShield: Exploiting Segmentation Hardware for Protecting against Buffer Overflow Attacks
复制标题
DOI：
10.1109/srds.2006.43
复制
发表时间：
2006-10
期刊：
影响因子：
--
通讯作者：
Takahiro Shinagawa
中科院分区：
文献类型：
--
作者：
Takahiro Shinagawa
提出了一种强大而有效的缓冲区溢出攻击防御方案。此方案的基本方法是指针复制：代码指针的副本存储在安全的存储区中，以检测和防止代码指针的操作。为了保护复制的代码指针不受数据指针修改攻击，该方案利用了IA-32(Intel X86)处理器的分段硬件。该方案提供了与通过系统调用对内存区进行写保护一样强大的保护。另一方面，这种方案涉及适度的开销，因为复制代码指针只需要几条用户级指令，而且不会有进入内核的损失。实验结果表明，OpenSSL的性能开销在0.9%到4.3%之间
This paper presents a strong and efficient scheme for protecting against buffer overflow attacks. The basic approach of this scheme is pointer copying: copies of code pointers are stored in a safe memory area to detect and prevent the manipulation of code pointers. In order to protect the copied code pointers from data-pointer modification attacks, this scheme exploits the segmentation hardware of IA-32 (Intel x86) processors. This scheme provides as strong protection as write-protecting the memory area via system calls. On the other hand, this scheme involves a modest overhead because copying a code pointer requires only a few user-level instructions and there is no penalty of entering the kernel. The experimental results show that the performance overhead in OpenSSL ranges from 0.9% to 4.3%