Detection of return oriented programming attacks

Patent metadata

Field	Value
Publication number	US-9582663-B2
Application number	US-201514960709-A
Country	US
Kind code	B2
Filing date	Dec 7, 2015
Priority date	Oct 31, 2012
Publication date	Feb 28, 2017
Grant date	Feb 28, 2017

Abstract

In one embodiment, a processor includes at least one execution unit and Return Oriented Programming (ROP) detection logic. The ROP detection logic may determine a ROP metric based on a plurality of control transfer events. The ROP detection logic may also determine whether the ROP metric exceeds a threshold. The ROP detection logic may also, in response to a determination that the ROP metric exceeds the threshold, provide a ROP attack notification.

First claim

What is claimed is:

1. A processor comprising:
a core including a fetch unit to fetch instructions, a decode unit to decode the fetched instructions, at least one execution unit to execute one or more of the decoded instructions and a first logic comprising at least one hardware circuit coupled to the at least one execution unit, the first logic to:
adjust a count in a first direction in response to detection of one or more control transfer events of a first type and adjust the count in a second direction in response to detection of one or more control transfer events of a second type; and
in response to a determination that the count exceeds a threshold, notify a protection agent of a possible Return Oriented Programming (ROP) attack.

2. The processor of claim 1 , wherein the first logic comprises an accumulator to store the count.

3. The processor of claim 1 , wherein the first logic is to increment the count in response to an instance of a subroutine return instruction, wherein the subroutine return instruction is a control transfer event of the first type.

4. The processor of claim 3 , wherein the first logic is to decrement the count in response to an instance of a subroutine call instruction, wherein the subroutine call instruction is a control transfer event of the second type.

5. The processor of claim 3 , wherein the first logic is further to increment the count in response to a return misprediction.

6. The processor of claim 3 , wherein the first logic is further to increment the count in response to an instance of a control transfer instruction associated with a stack pop instruction.

7. The processor of claim 3 , wherein the first logic is further to increment the count in response to an instance of a control transfer instruction associated with an increase in a stack pointer.

8. The processor of claim 1 , wherein the indication is to trigger the protection agent to take one or more actions to address the possible ROP attack.

9. The processor of claim 1 , wherein the first logic is further to freeze a branch instruction log when the count exceeds the threshold.

10. A system comprising:
a multicore processor including a plurality of cores, a shared cache memory and a memory controller, at least one of the plurality of cores comprising:
an accumulator to generate a count in response to detection of a plurality of types of control transfer events, wherein the accumulator is to update the count in a first direction in response to a first control transfer event type and update the count in a second direction in response to a second control transfer event type; and
a comparator to notify a protection application of a potential Return Oriented Programming (ROP) attack when the count exceeds a threshold during a window; and

a system memory coupled to the multicore processor.

11. The system of claim 10 , wherein the at least one core further comprises an instruction detector to detect an execution of a control transfer instruction, wherein the plurality of types of control transfer events includes the execution of the control transfer instruction.

12. The system of claim 10 , further comprising a return stack buffer to detect a return misprediction, wherein the plurality of types of control transfer events includes the return misprediction.

13. The system of claim 10 , wherein the at least one core further comprises a branch prediction unit to detect a branch misprediction, wherein the plurality of types of control transfer events includes the branch misprediction.

14. The system of claim 10 , wherein the plurality of types of control transfer events includes a pair of associated instructions.

15. The system of claim 10 , wherein the at least one core further comprises bias logic to adjust the count to reduce at least one bias effect due to a natural imbalance.

16. The system of claim 10 , wherein the at least one core further comprises control logic to adjust the threshold based on a desired level of protection against ROP attacks.

17. A non-transitory machine-readable medium having stored thereon instructions, which if performed by a machine cause the machine to perform a method comprising:
sending, by first logic of a processor, a detection signal regarding one or more call instructions and one or more return instructions in a retirement buffer of the processor;
updating, by second logic of the processor, a count in a first direction in response to the detection signal regarding the one or more call instructions and updating the count in a second direction in response to the detection signal regarding the one or more return instructions; and
in response to a determination that the count exceeds a threshold during a window, notifying a protection application of a possible Return Oriented Programming (ROP) attack.

18. The machine-readable medium of claim 17 , wherein the method further comprises updating the count in the second direction in response to a stack pivot.

19. The machine-readable medium of claim 17 , wherein the method further comprises updating the count in the second direction in response to a particular type of misprediction.

20. The machine-readable medium of claim 17 , wherein the method further comprises, in response to a determination that the count exceeds the threshold during the window, freezing contents of a branch instruction log of the processor.

Assignees

• Intel Corp

Inventors

• Fischer Stephen A
• Gotze Kevin C
• Bulygin Yuriy
• Brannock Kirk D

Classifications

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• G06F9/3806

  using address prediction, e.g. return stack, branch history buffer · CPC title

• G06F9/30145

  Instruction analysis, e.g. decoding, instruction word fields · CPC title

• G06F11/30

  Monitoring · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title