US 11,443,032 B2 · Stack pivot exploit detection and mitigation

Abstract

Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting exploits. In aspects, various “checkpoints” may be identified in software code. At each checkpoint, the current stack pointer, stack base, and stack limit for each mode of execution may be obtained. The current stack pointer for each mode of execution may be evaluated to determine whether the stack pointer falls within a stack range between the stack base and the stack limit of the respective mode of execution. When the stack pointer is determined to be outside of the expected stack range, a stack pivot exploit is detected and one or more remedial actions may be automatically performed.

Claims20

Dependent claims

A method comprising:

determining user mode and kernel mode software checkpoints for a process executing on a computing device;
for each determined software checkpoint encountered by the executing process:
identifying a current stack pointer and a range of memory for one or more execution modes associated with the process, wherein each of the one or more execution modes is associated with a specific stack memory, wherein the range of memory indicates a valid set of memory addresses between a stack base and a stack limit;
evaluating the current stack pointer for each of the one or more execution modes against the corresponding range of memory to determine whether the current stack pointer is within the range of the corresponding range of memory;
detecting a stack pivot exploit by determining when the current stack pointer is determined to be outside the range of the stack limit;
and
responsive to detecting a stack pivot exploit, performing one or more remedial actions.

4 more elements

Dependencies are inferred from the claim text.

Stack pivot exploit detection and mitigation

Life of this patent

Stack pivot exploit detection and mitigation

Life of this patent

Abstract

Claims20