Mitigating just-in-time spraying attacks in a network environment

Patent metadata

Field	Value
Publication number	US-9336383-B2
Application number	US-201514659950-A
Country	US
Kind code	B2
Filing date	Mar 17, 2015
Priority date	Mar 15, 2013
Publication date	May 10, 2016
Grant date	May 10, 2016

Abstract

An example method for mitigating JIT spraying attacks in a network environment is provided and includes protecting an output of a just-in-time (JIT) compiler against attacks during application execution at least by intervening from outside the application into a JIT page generated by the JIT compiler in a memory element of a host. In a specific embodiment, the intervening can include rewriting the JIT page. In specific embodiments, the method can further include generating a shadow page corresponding to the JIT page in the memory element. The method can further include randomly choosing at least one block of instructions in the JIT page, moving the at least one block of instructions to the shadow page, and replacing the at least one block of instructions in the JIT page with at least one of invalid opcodes and halt instructions.

First claim

What is claimed is:

1. A method, comprising:
randomly choosing, by a hypervisor executing in a host, an instruction in a JIT page, wherein the JIT page comprises a memory page storing a JIT compiled program comprising a plurality of instructions, wherein a plurality of virtual machines executes in the host, wherein the hypervisor controls the host's processor and memory for the virtual machines, wherein the JIT compiled program corresponds to an application executing in one of the virtual machines;
moving, by the hypervisor, the chosen instruction to a shadow page corresponding to the JIT page; and
replacing, by the hypervisor, the moved instruction in the JIT page with an interrupt instruction.

2. The method of claim 1 , wherein the method further comprises inserting a jump instruction to transfer execution of the JIT compiled program to the moved instruction in the shadow page.

3. The method of claim 1 , wherein a first byte of the moved instruction is replaced with the interrupt instruction.

4. The method of claim 1 , wherein during execution of the JIT compiled program, the interrupt instruction calls a debug exception handler.

5. The method of claim 1 , wherein any control transfer to the moved instruction during execution of the JIT compiled program triggers an exception and stops the execution.

6. The method of claim 1 , wherein the method further comprises inserting the moved instruction back into the JIT page from the shadow page during a read or write of the JIT compiled program.

7. The method of claim 6 , wherein the JIT page is marked as execute, wherein the method further comprises:
generating an error when the application calls the JIT page marked as execute to read or write; and
deleting the moved instruction from the shadow page.

8. The method of claim 1 , wherein the shadow page is allocated to the JIT page by the application associated with the JIT compiled program.

9. The method of claim 1 , further comprising injecting an instruction into the JIT compiled program to allocate the shadow page.

10. The method of claim 1 , further comprising generating metadata corresponding to a location in the shadow page associated with the moved instruction.

11. One or more non-transitory tangible media encoding logic that includes instructions for execution, which when executed by a processor of a host, is operable to perform operations comprising:
randomly choosing, by a hypervisor executing in the host, an instruction in a JIT page, wherein the JIT page comprises a memory page storing a JIT compiled program comprising a plurality of instructions, wherein a plurality of virtual machines executes in the host, wherein the hypervisor controls the host's processor and memory for the virtual machines, wherein the JIT compiled program corresponds to an application executing in one of the virtual machines;
moving, by the hypervisor, the chosen instruction to a shadow page corresponding to the JIT page; and
replacing, by the hypervisor, the moved instruction in the JIT page with an interrupt instruction.

12. The media of claim 11 , wherein the JIT page is marked as execute, wherein the operations further comprise:
generating an error when the application calls the JIT page marked as execute to read or write;
inserting the moved instruction back into the JIT page from the shadow page; and
deleting the moved instruction from the shadow page.

13. The media of claim 11 , the operations further comprising inserting a jump instruction to transfer execution of the JIT compiled program to the moved instruction in the shadow page.

14. The media of claim 11 , wherein any control transfer to the moved instruction during execution of the JIT compiled program triggers an exception and stops the execution.

15. The media of claim 11 , wherein the shadow page is allocated to the JIT page by the application associated with the JIT compiled program.

16. An apparatus, comprising:
a plurality of executing virtual machines;
a memory element for storing data;
a processor that executes instructions associated with the data; and
a hypervisor controlling the processor and the memory element for the virtual machines, wherein the processor and the memory element cooperate such that the apparatus is configured for:
randomly choosing, by the hypervisor, an instruction in a JIT page, wherein the JIT page comprises a memory page storing a JIT compiled program comprising a plurality of instructions;
moving, by the hypervisor, the chosen instruction to a shadow page corresponding to the JIT page; and
replacing, by the hypervisor, the moved instruction in the JIT page with an interrupt instruction.

17. The apparatus of claim 16 , wherein the JIT page is marked as execute, wherein the apparatus is further configured for:
generating an error when the application calls the JIT page marked as execute to read or write;
inserting the moved instruction back into the JIT page from the shadow page; and
deleting the moved instruction from the shadow page.

18. The apparatus of claim 16 , further configured for inserting a jump instruction to transfer execution of the JIT compiled program to the moved instruction in the shadow page.

19. The apparatus of claim 16 , wherein any control transfer to the moved instruction during execution of the JIT compiled program triggers an exception and stops the execution.

20. The apparatus of claim 16 , wherein the shadow page is allocated to the JIT page by the application associated with the JIT compiled program.

Assignees

• Cisco Tech Inc

Inventors

• Salamat Babak
• Epstein Joseph

Classifications

• G06F13/24 Primary

  using interrupt (G06F13/32 takes precedence) · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F9/5016

  the resource being the memory · CPC title

• G06F2221/031

  Protect user input by software means · CPC title

• G06F9/4552

  Involving translation to a different instruction set architecture, e.g. just-in-time translation in a JVM · CPC title