Attack Protection for valid gadget control transfers

Patent metadata

Field	Value
Publication number	US-9767272-B2
Application number	US-201414518507-A
Country	US
Kind code	B2
Filing date	Oct 20, 2014
Priority date	Oct 20, 2014
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

In one embodiment, a processor comprises: a first register to store a first bound value for a stack to be stored in a memory; a second register to store a second bound value for the stack; a checker logic to determine, prior to an exit point at a conclusion of a function to be executed on the processor, whether a value of a stack pointer is within a range between the first bound value and the second bound value; and a logic to prevent a return to a caller of the function if the stack pointer value is not within the range. Other embodiments are described and claimed.

First claim

What is claimed is:

1. A processor comprising:
a first hardware register to store a first bound value for a stack to be stored in a memory;
a second hardware register to store a second bound value for the stack;
a checker logic to determine, prior to an exit point at a conclusion of a function to be executed on the processor, whether a value of a stack pointer is within a range between the first bound value and the second bound value;
a logic to prevent a return to a caller of the function if the stack pointer value is not within the range; and
a second logic to store a random value in a third register prior to a call to the function, and in response to a control transfer termination (CTT) instruction encountered after a control transfer instruction that returns from the function, determine whether a current value of the third register equals the random value, and if so, continue execution of the caller of the function, and otherwise to terminate execution.

2. The processor of claim 1 , wherein the logic is to raise an exception if the stack pointer value is not within the range.

3. The processor of claim 2 , wherein the exception is to indicate a stack pivot attack.

4. The processor of claim 2 , further comprising control logic to terminate the program responsive to the exception.

5. The processor of claim 1 , wherein the checker logic is further to determine, prior to a second exit point of the function, whether the value of the stack pointer is within the range.

6. The processor of claim 1 , wherein the first register and the second register comprise a single register.

7. The processor of claim 1 , wherein the checker logic is to execute at least one user level instruction to determine whether the value of the stack pointer is within the range.

8. At least one non-transitory computer readable storage medium comprising instructions that when executed enable a system to:
store, in a first register, a first bound value for a stack to be stored in a memory; store, in a second register, a second bound value for the stack;
determine, prior to an exit point at a conclusion of a function, whether a value of a stack pointer is within a range between the first bound value and the second bound value;
prevent a return to a caller of the function if the stack pointer value is not within the range; and
store a random value in a third register prior to a call to the function, and in response to a control transfer termination (CTT) instruction encountered after a control transfer instruction that returns from the function, determine whether a current value of the third register equals the random value, and if so, continue execution of the caller of the function, and otherwise to terminate execution.

9. The non-transitory computer readable storage medium of claim 8 , further comprising instructions that when executed enable the system to raise an exception if the stack pointer value is not within the range.

10. The non-transitory computer readable storage medium of claim 9 , wherein the exception is to indicate a stack pivot attack.

11. The non-transitory computer readable storage medium of claim 9 , further comprising instructions that when executed enable the system to terminate the program responsive to the exception.

12. The non-transitory computer readable storage medium of claim 8 , further comprising instructions that when executed enable the system to determine, prior to a second exit point of the function, whether the value of the stack pointer is within the range.

13. The non-transitory computer readable storage medium of claim 8 , further comprising instructions that when executed enable the system to execute at least one user level instruction to determine whether the value of the stack pointer is within the range.

Assignees

• Intel Corp

Inventors

• Shanbhogue Vedvyas
• Sahita Ravi L
• Bulygin Yuriy
• Li Xiaoning
• Brandt Jason W

Classifications

• G06F9/30021

  Compare instructions, e.g. Greater-Than, Equal-To, MINMAX · CPC title

• G06F9/30134

  Register stacks; shift registers · CPC title

• G06F9/30076

  to perform miscellaneous control operations, e.g. NOP · CPC title

• G06F9/4484

  Executing subprograms · CPC title

• G06F9/3861

  Recovery, e.g. branch miss-prediction, exception handling (error detection or correction G06F11/00) · CPC title