Stack pivot exploit detection and mitigation
AssigneeWebroot Inc.
InventorAndrew Sandoval
Life of this patent
Estimating the term…
Abstract
Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting exploits. In aspects, various “checkpoints” may be identified in software code. At each checkpoint, the current stack pointer, stack base, and stack limit for each mode of execution may be obtained. The current stack pointer for each mode of execution may be evaluated to determine whether the stack pointer falls within a stack range between the stack base and the stack limit of the respective mode of execution. When the stack pointer is determined to be outside of the expected stack range, a stack pivot exploit is detected and one or more remedial actions may be automatically performed.
Claims20
A system comprising:
- at least one processor;
- and
- memory coupled to the at least one processor, the memory comprising computer executable instructions executable by the at least one processor to:
- for each software checkpoint encountered by an executing process:
- identifying a current stack pointer and a stack range for each of a kernel execution mode, a 32-bit execution mode, and a 64-bit execution mode associated with the process, wherein each of the stack ranges indicates a set of memory addresses between a respective stack base and a respective stack limit;
- evaluating the current stack pointer for each of the kernel, 32-bit, and 64-bit execution modes against the corresponding stack range to determine whether the respective current stack pointer is within the corresponding stack range;
- and
- when at least one of the current stack pointers is determined to be outside the corresponding stack range, performing one or more remedial actions.
A method comprising:
- for each software checkpoint encountered by an executing process:
- identifying a current stack pointer and a stack range for each of a kernel execution mode, a 32-bit execution mode, and a 64-bit execution mode associated with the process, wherein each of the stack ranges indicates a set of memory addresses between a respective stack base and a respective stack limit;
- evaluating the current stack pointer for each of the kernel, 32-bit, and 64-bit execution modes against the corresponding stack range to determine whether the respective current stack pointer is within the corresponding stack range;
- and
- when at least one of the current stack pointers is determined to be outside the range of the respective stack limit, performing one or more remedial actions.
A non-transitory computer-readable media storing computer executable instructions that when executed cause a computing system to perform a method comprising:
- for each software checkpoint encountered by an executing process:
- identifying a current stack pointer and a stack range for each of a kernel execution mode, a 32-bit execution mode, and a 64-bit execution mode associated with the process, wherein each of the stack ranges indicates a set of memory addresses between a respective stack base and a respective stack limit;
- evaluating the current stack pointer for each of the kernel, 32-bit, and 64-bit execution modes against the corresponding stack range to determine whether the respective current stack pointer is within the range of the corresponding stack range;
- and
- when at least one of the current stack pointers is determined to be outside the range of the corresponding stack rage, performing one or more remedial actions.
Dependencies are inferred from the claim text.