Attack Protection For Valid Gadget Control Transfers

Patent metadata

Field	Value
Publication number	US-2016110542-A1
Application number	US-201414518507-A
Country	US
Kind code	A1
Filing date	Oct 20, 2014
Priority date	Oct 20, 2014
Publication date	Apr 21, 2016
Grant date	—

Abstract

In one embodiment, a processor comprises: a first register to store a first bound value for a stack to be stored in a memory; a second register to store a second bound value for the stack; a checker logic to determine, prior to an exit point at a conclusion of a function to be executed on the processor, whether a value of a stack pointer is within a range between the first bound value and the second bound value; and a logic to prevent a return to a caller of the function if the stack pointer value is not within the range. Other embodiments are described and claimed.

First claim

What is claimed is:

1 . A processor comprising:
a first register to store a first bound value for a stack to be stored in a memory; a second register to store a second bound value for the stack; a checker logic to determine, prior to an exit point at a conclusion of a function to be executed on the processor, whether a value of a stack pointer is within a range between the first bound value and the second bound value; and a logic to prevent a return to a caller of the function if the stack pointer value is not within the range.

2 . The processor of claim 1 , wherein the logic is to raise an exception if the stack pointer value is not within the range.

3 . The processor of claim 2 , wherein the exception is to indicate a stack pivot attack.

4 . The processor of claim 2 , further comprising control logic to terminate the program responsive to the exception.

5 . The processor of claim 1 , wherein the checker logic is further to determine, prior to a second exit point of the function, whether the value of the stack pointer is within the range.

6 . The processor of claim 1 , wherein the first register and the second register comprise a single register.

7 . The processor of claim 1 , wherein the checker logic is to execute at least one user level instruction to determine whether the value of the stack pointer is within the range.

8 . The processor of claim 1 , further comprising a second logic to store a random value in a third register prior to a call to the function, and responsive to a control transfer termination (CTT) instruction encountered after a control transfer operation that returns from the function, determine whether a current value of the third register equals the random value, and if so, continue execution of a caller of the function, and otherwise to terminate execution.

9 . At least one computer readable medium including instructions that when executed enable a system to:
during execution of a process on a processor of the system and prior to a call to a function, store a first value in a first register of a plurality of registers of the processor; responsive to a control transfer termination (CTT) instruction encountered after a control transfer operation that returns from the function, determine whether a current value of the first register equals the first value; and if so, continue execution of the process, and otherwise raise a violation.

10 . The at least one computer readable medium of claim 9 , further comprising instructions that when executed enable the system to, during execution of the function, store the first value of the first register to a storage, use the first register to store a first function value and, prior to a termination of the function, to restore the first value from the storage to the first register, the first value comprising a random value.

11 . The at least one computer readable medium of claim 9 , wherein to raise the violation comprises a fault to indicate presence of a malware attack in which the function is at least one of improperly entered or improperly exited.

12 . The at least one computer readable medium of claim 9 , further comprising instructions that when executed enable the system, responsive to the violation, to perform one or more of termination of the process, shutdown of the system, and shutdown of a guest that caused the violation.

13 . The at least one computer readable medium of claim 9 , wherein the processor comprises an interlock register, the interlock register corresponding to the first register.

14 . The at least one computer readable medium of claim 9 , wherein to raise the violation comprises insertion of a CTT fault micro-operation into a pipeline of the processor.

15 . The at least one computer readable medium of claim 9 , further comprising instructions that when executed enable the system to save a value of the first register to a stack before the call to the function.

16 . The at least one computer readable medium of claim 15 , further comprising instructions that when executed enable the system to restore the value of the first register from the stack to the first register upon the continued process execution.

17 . The at least one computer readable medium of claim 9 , further comprising instructions that when executed enable the system to set a page to an execute only status, the page including the instructions to store the random value in the first register via immediate parameters.

18 . The at least one computer readable medium of claim 17 , further comprising instructions that when executed enable the system to update an extended page table entry associated with the page to the execute only status, wherein an entry associated with the page in a first page table is set to a read execute status.

19 . A method comprising:
associated with a control transfer termination instruction, copying a return address of a function executed on a processor of a system and called during execution of a program to a top entry of a shadow stack of a memory, the return address further stored in a stack of the memory; at a conclusion of the function, comparing the return address stored in the stack to a value stored in the top entry of the shadow stack; and if the return address stored in the stack matches the value stored in the top entry of the shadow stack, returning to a caller of the function, and otherwise terminating the program.

20 . The method of claim 19 , further comprising copying the return address to the top entry of the shadow stack at an entry point to the function.

21 . The method of claim 19 , further comprising removing the value stored in the top entry from the shadow stack at the conclusion of the function.

22 . The method of claim 19 , wherein the shadow stack comprises a software managed stack.

23 . The method of claim 22 , further comprising maintaining the shadow stack in one or more pages of a memory, the one or more pages having a non-read-writable status and only accessible to a trusted code agent that manages the software managed stack.

Assignees

• Intel Corp

Inventors

• Shanbhogue Vedvyas
• Sahita Ravi L
• Bulygin Yuriy
• Li Xiaoning
• Brandt Jason W

Classifications

• G06F9/4484

  Executing subprograms · CPC title

• G06F9/30076

  to perform miscellaneous control operations, e.g. NOP · CPC title

• G06F9/30134

  Register stacks; shift registers · CPC title

• G06F9/30021

  Compare instructions, e.g. Greater-Than, Equal-To, MINMAX · CPC title

• G06F9/3861

  Recovery, e.g. branch miss-prediction, exception handling (error detection or correction G06F11/00) · CPC title