Arxiv:2003.05503V3 [Cs.CR] 19 Apr 2021

Bypassing memory safety mechanisms through speculative control flow hijacks Andrea Mambretti1,2, Alexandra Sandulescu1, Alessandro Sorniotti1, William Robertson2, Engin Kirda2, and Anil Kurmus1 1IBM Research – Zurich, Rüschlikon, Switzerland {asa, aso, kur}@zurich.ibm.com 2Northeastern University, Boston, USA {mbr, wkr, ek}@ccs.neu.edu Abstract—The prevalence of memory corruption bugs in of modern computing systems against memory corruption the past decades resulted in numerous defenses, such as attacks: does the security of memory safety mechanisms, stack canaries, control flow integrity (CFI), and memory- such as stack smashing protection (SSP), control flow safe languages. These defenses can prevent entire classes of integrity (CFI), and those embedded in memory safe vulnerabilities, and help increase the security posture of a languages, hold in the post-Spectre threat model? program. In this paper, we show that memory corruption In this paper, we show that multiple memory safety defenses can be bypassed using speculative execution attacks. mechanisms that would otherwise successfully prevent ex- We study the cases of stack protectors, CFI, and bounds ploitation of vulnerabilities can be speculatively bypassed checks in Go, demonstrating under which conditions they to perform arbitrary memory reads. Because these attacks can be bypassed by a form of speculative control flow require a combination of techniques, we show that they do hijack, relying on speculative or architectural overwrites of not apply to all memory safety mechanisms and a careful, control flow data. Information is leaked by redirecting the case-by-case analysis is necessary. speculative control flow of the victim to a gadget accessing At a high level, these attacks work by overwriting, secret data and acting as a side channel send. We also either architecturally or speculatively, a backwards or for- demonstrate, for the first time, that this can be achieved by ward edge, followed by the use of speculative code reuse attacks to leak data. In all cases, this overwrite achieves stitching together multiple gadgets, in a speculative return- a speculative control flow hijack, i.e., a redirection of the oriented programming attack. We discuss and implement speculative control flow to an attacker-chosen arbitrary ad- software mitigations, showing moderate performance impact. dress. One case of such an attack is the speculative buffer overflow discovered by Kiriansky and Waldspurger [21], Index Terms—Transient Execution, Hardware Security, Side where a return address is speculatively overwritten. Channels, Speculative ROP, Memory Safety Mechanisms, We demonstrate that SSP, GCC’s vtable verification Operating System Security (VTV), and Go’s runtime memory safety checks are all vulnerable. In particular, we develop a practical attack against SSP, where the mitigations against a stack-based 1. Introduction buffer overflow in libpng can be speculatively bypassed to read arbitrary bytes from the victim program. This Memory corruption vulnerabilities have plagued the attack additionally leverages a last level cache (LLC) evic- computer security field for more than 30 years. Multiple tion attack to extend the speculative execution window, ways of exploiting memory bugs have surfaced, requiring and a speculative return-oriented programming (ROP) at- controls to be placed at different levels in the software tack to achieve a Flush+Reload side channel by reusing 5 stack: mechanisms such as stack canaries and control flow gadgets from the victim program. Both components of the arXiv:2003.05503v3 [cs.CR] 19 Apr 2021 integrity have been designed and deployed as a mitigation attack are not specific to SSP and generalize beyond our in existing software, while new languages were designed selected use case. Our results demonstrate that, although with memory safety to close this class of bugs in new such end-to-end attacks are not trivial to mount, they are programs [42], [46]. realistic. For this reason, we evaluate countermeasures for Recently, a new class of attacks, transient execution each attack scenario, showing that mitigations are both attacks [11], and more specifically speculative execution effective and viable from a performance standpoint. attacks [23], [21], [29], [25], [40], [10], [32] have been This paper makes the following contributions: the subject of intense scrutiny. The ensuing vulnerabilities • Demonstration of a practical attack against SSP- appear difficult to mitigate without considerable perfor- based buffer overflow mitigations, together with mance trade-offs, leading to the conclusion that specu- proof-of-concept attacks against GCC VTable Verifi- lative execution attacks will remain a problem for the cation (VTV) and against Go’s array bounds checks. foreseeable future, and therefore a possibly fruitful area • Demonstration of speculation window lengthening of research [34]. leveraging LLC eviction of victim data. A natural question to ask is whether the advent of • Practical speculative code reuse attack (ROP) to transient execution attacks has changed the security stance achieve side-channel send. • Custom mitigations derived from lfence-based and assume a hyperthread-colocated attacker, thereby sharing masking-based approaches, withstanding the class of the instruction cache with the victim program, which the speculative architectural control flow hijacking at- attacker leverages during the ROP chain warm-up phase. tacks, together with a performance evaluation. The goal of the attacker is, as in all transient execution attacks, to leak secrets from the target program. Attacks 2. Speculative execution attacks on memory based on the architectural overwrite of a backward or forward edge correspond to the case where an attacker safety mechanisms can provoke a memory safety violation whose traditional exploitation is prevented by hardening mechanisms in In this section, we describe end-to-end speculative place. This is demonstrated in the SSP and CFI use cases. execution attacks on abstracted memory safety mecha- In this case, we assume that the victim program can either nisms. We begin with a high-level overview of the various be executed multiple times by the attacker or that the components necessary to perform such an end-to-end at- program automatically restarts, given that each attack run tack. We then proceed to analyze the class of speculative leaks a limited volume of information and likely leads to control flow hijacks which is at the heart of the attack; abnormal program termination. This assumption remains we refer to this general category of attacks as SPEculative realistic in practice because modern Linux distributions ARchitectural control flow hijacks, or SPEAR, and detail with systemd automatically restart services after abnor- them in Section 2.1. Furthermore, we analyze the eviction mal termination. mechanism in Section 2.2, and the speculative ROP in Attacks based on the speculative overwrite of a for- Section 2.3. ward edge correspond to a victim program with a memory safety check that the attacker can exercise and speculatively bypass. This is demonstrated in the Go use case. In this case, given that the overwrite of control flow data occurs speculatively, the attack does not lead to program termination, and so the attack does not require the ability to restart the victim. Figure 1: Overview of speculative attack against memory safety 2.1. SPEAR attacks mechanisms. A SPEAR-vulnerable sequence is a code sequence that Figure 1 shows an overview of the steps required to results in a speculative control flow hijack. A speculative perform an end-to-end attack. The attack has a preparation control flow hijack allows an attacker to gain control of phase (Steps 1 and 2), where eviction sets (to ensure the target program’s speculatively-executed code. This is a the existence of a suitably long speculation window) are powerful primitive: an attacker can follow such an attack identified, memory used by the side channel is flushed with a speculative ROP sequence to speculatively execute and ROP gadgets are primed in the instruction cache. The code gadgets that access a secret and send it to the attacker attacker then submits an input to the victim in Step 3, via a side channel. crafted to trigger a violation of a memory safety property. We assume that traditional exploitation of the violation is prevented by a suitable memory safety mechanism. However, the attacker uses a speculative execution attack to bypass the mechanism by overwriting (architecturally or speculatively) control-flow data, and obtaining a speculative control flow hijack (Step 5). As a result, the victim is tricked into executing a side-channel send of attacker-chosen memory in Step 6: this is achieved with the ROP component, which reuses code snippets from Figure 2: Overview of various Speculative control flow hijack- the victim program, appropriately selected and primed in ing attacks. the initialization phase. The attacker can then execute the corresponding side-channel receive in Step 7. The success Figure 2 shows a breakdown of the various instances in rate of the attack is increased by concurrently executing the SPEAR attack class in the context of different variants an eviction loop to lengthen the speculation window (Step of speculative control flow hijacks. Classic speculative 4) using the eviction sets found in Step 1. control flow hijacking attacks can be performed through Threat model: The general threat model for all attacks microarchitectural components such as the Branch Target in this

Load more