Back to results
US 10,650,141 B2Granted
Mitigation of return-oriented programming attacks
AssigneeSophos Limited
InventorsErik Jan Loman, Lute Edwin Engels, Andrew J. Thomas, Kenneth D. Ray
Life of this patent
Estimating the term…
Abstract
Trampoline and return-oriented programming attacks employ a variety of techniques to maliciously execute instructions on a device in a manner different from a legitimate programmer's original intent. By instrumenting a device to detect deviations from predicted behavior, these exploits can be identified and mitigated.
Claims20
A computer program product for mitigating trampoline-based attacks, the computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on one or more processors, performs the steps of:
- providing a computing device executing an operating system with a user space and a system space;
- configuring the computing device to detour one or more function calls for kernel functions to one or more stub locations corresponding to one or more security processes that provide predetermined return addresses for the kernel functions;
- constructing an array including ordinals identifying the kernel functions and, for each one of the ordinals, a respective stub location of one of the one or more security processes for one of the kernel functions identified by the given one of the ordinals;
- when a call for a memory function of the kernel functions is made from a process executing in the user space into a kernel executing in the system space, detouring the call to one of the security processes;
- in the one of the one or more security processes, determining a predicted return address and a predicted ordinal for the call using a lookup in the array;
- performing a comparison of the predicted return address and the predicted ordinal from the array to an actual return address and an actual ordinal for a function of the call;
- detecting a possible return-oriented programming attack when a mismatch is detected during the comparison;
- and
- returning control to a calling process that initiated the call to the function.
6 more elements
A method comprising:
- providing a computing device executing an operating system with a user space and a system space;
- configuring the computing device to detour one or more function calls for kernel functions to one or more stub locations corresponding to one or more security processes that provide predetermined return addresses for the kernel functions;
- constructing an array including ordinals identifying the kernel functions and, for each one of the ordinals, a respective stub location of one of the one or more security processes for one of the kernel functions identified by the given one of the ordinals;
- when a call is made from a process executing in the user space into a kernel executing in the system space, detouring the call to one of the security processes;
- in the one of the one or more security processes, determining a predicted return address and a predicted ordinal for the call using a lookup in the array;
- performing a comparison of the predicted return address and the predicted ordinal from the array to an actual return address and an actual ordinal for a function of the call;
- and
- detecting a possible return-oriented programming attack based on a mismatch in the comparison.
5 more elements
A system comprising:
- one or more processors executing an operating system with a user space and a system space;
- a memory for non-transitory storage of computer-readable data;
- and
- computer executable code stored in the memory and executable by the one or more processors to perform the steps of configuring the one or more processors to detour one or more function calls for kernel functions to one or more stub locations corresponding to one or more security processes that provide predetermined return addresses for the kernel functions, constructing an array including ordinals identifying the kernel functions and, for each one of the ordinals, a respective stub location of one of the one or more security processes for one of the kernel functions identified by the given one of the ordinals, when a call for a function of the kernel functions is made from a process executing in the user space into a kernel executing in the system space, detouring the call to one of the security processes, determining a predicted return address and a predicted ordinal for the call using a lookup in the array, performing a comparison of the predicted return address and the predicted ordinal from the array to an actual return address and an actual ordinal for a function of the call, and detecting a possible return-oriented programming attack when a mismatch is detected during the comparison.
1 more element
Dependencies are inferred from the claim text.