Jump-Oriented Programming: A New Class of Code-Reuse Attack Tyler Bletsch, Xuxian Jiang, Vince W. Freeh Zhenkai Liang Department of Computer Science School of Computing North Carolina State University National University of Singapore {tkbletsc, xuxian_jiang, vwfreeh}@ncsu.edu
[email protected] ABSTRACT to redirect control flow to the attacker-supplied code. How- Return-oriented programming is an effective code-reuse at- ever, with the advent of CPUs and operating systems that tack in which short code sequences ending in a ret instruc- support the W⊕X guarantee [3], this threat has been mit- tion are found within existing binaries and executed in ar- igated in many contexts. In particular, W⊕X enforces the bitrary order by taking control of the stack. This allows property that \a given memory page will never be both for Turing-complete behavior in the target program without writable and executable at the same time." The basic premise the need for injecting attack code, thus significantly negat- behind it is that if a page cannot be written to and later ex- ing current code injection defense efforts (e.g., W⊕X). On ecuted from, code injection becomes impossible. the other hand, its inherent characteristics, such as the re- Unfortunately, attackers have developed innovative ways liance on the stack and the consecutive execution of return- to defeat W⊕X. For example, one possible way is to launch oriented gadgets, have prompted a variety of defenses to a code-reuse attack, wherein existing code is re-purposed to detect or prevent it from happening. a malicious end.