Attack Protection For Valid Gadget Control Transfers
AssigneeIntel Corporation
InventorsVedvyas Shanbhogue, Ravi L. Sahita, Yuriy Bulygin, Xiaoning Li, Jason W. Brandt
Life of this patent
Estimating the term…
Abstract
In one embodiment, a processor comprises: a first register to store a first bound value for a stack to be stored in a memory; a second register to store a second bound value for the stack; a checker logic to determine, prior to an exit point at a conclusion of a function to be executed on the processor, whether a value of a stack pointer is within a range between the first bound value and the second bound value; and a logic to prevent a return to a caller of the function if the stack pointer value is not within the range. Other embodiments are described and claimed.
Claims23
A processor comprising:
- a first register to store a first bound value for a stack to be stored in a memory;
- a second register to store a second bound value for the stack;
- a checker logic to determine, prior to an exit point at a conclusion of a function to be executed on the processor, whether a value of a stack pointer is within a range between the first bound value and the second bound value;
- and
- a logic to prevent a return to a caller of the function if the stack pointer value is not within the range.
At least one computer readable medium including instructions that when executed enable a system to:
- during execution of a process on a processor of the system and prior to a call to a function, store a first value in a first register of a plurality of registers of the processor;
- responsive to a control transfer termination (CTT) instruction encountered after a control transfer operation that returns from the function, determine whether a current value of the first register equals the first value;
- and
- if so, continue execution of the process, and otherwise raise a violation.
A method comprising:
- associated with a control transfer termination instruction, copying a return address of a function executed on a processor of a system and called during execution of a program to a top entry of a shadow stack of a memory, the return address further stored in a stack of the memory;
- at a conclusion of the function, comparing the return address stored in the stack to a value stored in the top entry of the shadow stack;
- and
- if the return address stored in the stack matches the value stored in the top entry of the shadow stack, returning to a caller of the function, and otherwise terminating the program.
Dependencies are inferred from the claim text.