TyPro: Forward CFI for C-Style Indirect Function Calls Using Type Propagation

Bauer, Markus and Grishchenko, Ilya and Rossow, Christian
(2022) TyPro: Forward CFI for C-Style Indirect Function Calls Using Type Propagation.
In: Annual Computer Security Applications Conference (ACSAC 2022), December 5-9, 2022, Austin, Texas, USA.
Conference: ACSAC Annual Computer Security Applications Conference
(In Press)

[img]
Preview
 Text
TyPro-for-ACSAC-2022.pdf
Download (803kB) | Preview

Abstract

Maliciously-overwritten function pointers in C programs often lead to arbitrary code execution. In principle, forward CFI schemes mitigate this problem by restricting indirect function calls to valid call targets only. However, existing forward CFI schemes either depend on specific hardware capabilities, or are too permissive (weakening security guarantees) or too strict (breaking compatibility). We present TyPro, a Clang-based forward CFI scheme based on type propagation. TyPro uses static analysis to follow function pointer types through C programs, and can determine the possible target functions for indirect calls at compile time with high precision. TyPro does not underestimate possible targets and does not break real-world programs, including those relying on dynamically-loaded code. TyPro has no runtime overhead on average and does not depend on architecture or special hardware features.

Item Type: Conference or Workshop Item (A Paper) (Paper)
Divisions: Christian Rossow (System Security Group, SysSec)
Conference: ACSAC Annual Computer Security Applications Conference
Depositing User: Markus Bauer
Date Deposited: 08 Sep 2022 09:47
Last Modified: 08 Sep 2022 09:47
Primary Research Area: NRA3: Threat Detection and Defenses
URI: https://publications.cispa.saarland/id/eprint/3768

Actions

Actions (login required)

View Item View Item
CISPA is powered by EPrints 3 which is developed by the School of Electronics and Computer Science at the University of Southampton. More information and software credits.