Detection of return oriented programming attacks

Patent metadata

Field	Value
Publication number	US-9946875-B2
Application number	US-201715398930-A
Country	US
Kind code	B2
Filing date	Jan 5, 2017
Priority date	Oct 31, 2012
Publication date	Apr 17, 2018
Grant date	Apr 17, 2018

Abstract

In one embodiment, a processor includes at least one execution unit and Return Oriented Programming (ROP) detection logic. The ROP detection logic may determine a ROP metric based on a plurality of control transfer events. The ROP detection logic may also determine whether the ROP metric exceeds a threshold. The ROP detection logic may also, in response to a determination that the ROP metric exceeds the threshold, provide a ROP attack notification.

First claim

What is claimed is:

1. A processor comprising:
a core including a fetch unit to fetch instructions, a decode unit to decode the fetched instructions, at least one execution unit to execute one or more of the decoded instructions and a hardware detection circuit coupled to the at least one execution unit, the hardware detection circuit to:
adjust a count in a first direction in response to detection of one or more control transfer events of a first type and adjust the count in a second direction in response to detection of one or more control transfer events of a second type;
determine a Return Oriented Programming (ROP) metric based at least in part on a plurality of control transfer events; and
in response to a determination that the ROP metric exceeds a threshold, notify a protection agent to indicate detection of a possible ROP attack.

2. The processor of claim 1 , wherein the hardware detection circuit is to increment the count in response to an instance of a subroutine return instruction, wherein the subroutine return instruction is a control transfer event of the first type.

3. The processor of claim 2 , wherein the hardware detection circuit is to decrement the count in response to an instance of a subroutine call instruction, wherein the subroutine call instruction is a control transfer event of the second type.

4. The processor of claim 2 , wherein the hardware detection circuit is further to increment the count in response to a return misprediction.

5. The processor of claim 2 , wherein the hardware detection circuit is further to increment the count in response to an instance of a control transfer instruction associated with a stack pop instruction.

6. The processor of claim 2 , wherein the hardware detection circuit is further to increment the count in response to an instance of a control transfer instruction associated with an increase in a stack pointer.

7. The processor of claim 1 , wherein the hardware detection circuit comprises an accumulator to store the count.

8. The processor of claim 1 , wherein the indication is to trigger the protection agent to take one or more actions to address the possible ROP attack.

9. The processor of claim 1 , wherein the hardware detection circuit is further to freeze a branch instruction log when the ROP metric exceeds the threshold.

10. A system comprising:
a multicore processor including a plurality of cores, a shared cache memory and a power controller, at least one of the plurality of cores comprising:
an accumulator to generate a count in response to detection of a plurality of types of control transfer events, wherein the accumulator is to increment the count in response to a first control transfer event type and decrement the count in response to a second control transfer event type; and
a comparator to notify a protection application of a potential Return Oriented Programming (ROP) attack when the count exceeds a threshold during a window; and

a system memory coupled to the multicore processor to store the protection application, wherein the protection application is to take at least one action to address the potential ROP attack.

11. The system of claim 10 , wherein the at least one core further comprises an instruction detector to detect an execution of a control transfer instruction, wherein the plurality of types of control transfer events includes the execution of the control transfer instruction.

12. The system of claim 10 , further comprising a return stack buffer to detect a return misprediction, wherein the plurality of types of control transfer events includes the return misprediction.

13. The system of claim 10 , wherein the at least one core further comprises a branch prediction unit to detect a branch misprediction, wherein the plurality of types of control transfer events includes the branch misprediction.

14. The system of claim 10 , wherein the plurality of types of control transfer events includes a pair of associated instructions.

15. The system of claim 10 , wherein the at least one core further comprises bias logic to adjust the count to reduce at least one bias effect due to a natural imbalance.

16. The system of claim 10 , wherein the at least one core further comprises control logic to adjust the threshold based on a desired level of protection against ROP attacks.

17. A method comprising:
sending, by a detection circuit of a processor, a detection signal regarding one or more call instructions and one or more return instructions executed in the processor;
decrementing a count in response to the detection signal regarding the one or more call instructions and incrementing the count in response to the detection signal regarding the one or more return instructions;
determining whether the count exceeds a threshold; and
in response determining that the count exceeds the threshold, notifying a protection application of a possible Return Oriented Programming (ROP) attack.

18. The method of claim 17 , further comprising incrementing the count in response to at least one of a stack pivot and a misprediction.

19. The method of claim 17 , further comprising, in response to determining that the count exceeds the threshold, freezing contents of a branch instruction log of the processor.

Assignees

• Intel Corp

Inventors

• Fischer Stephen A
• Gotze Kevin C
• Bulygin Yuriy
• Brannock Kirk D

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F11/30

  Monitoring · CPC title

• G06F9/30145

  Instruction analysis, e.g. decoding, instruction word fields · CPC title

• G06F9/3806

  using address prediction, e.g. return stack, branch history buffer · CPC title