Mitigation of return-oriented programming exploits
AssigneeIntel Corporation
InventorsKe Sun, Rodrigo Branco, Kekai Hu
Life of this patent
Estimating the term…
Abstract
A computing apparatus, including: a processor; a memory; and encoded logic to instruct the processor to: identify within the memory a payload that is suspected to be a return-oriented programming (ROP) chain; execute the suspected ROP chain in a speculative execution path within the processor; force a missed prediction of the speculative execution path; determine that the suspected ROP chain executed through; and take a security action responsive to the determining.
Claims20
A computing apparatus, comprising:
- a processor;
- a memory;
- and
- encoded logic to instruct the processor to:
- identify within the memory a payload that is suspected to be a return-oriented programming (ROP) chain;
- execute the suspected ROP chain in a speculative execution path within the processor;
- force a missed prediction of the speculative execution path;
- determine that the suspected ROP chain executed through;
- and
- take a security action responsive to the determining.
One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions to:
- dynamically scan a binary object to identify a potential return-oriented programming (ROP) chain;
- append a canary instruction to the end of the potential ROP chain;
- execute the potential ROP chain;
- determine that the canary instruction was executed;
- and
- based at least in part on the determining, designate the potential ROP chain as an ROP chain.
A computer-implemented method of detecting a return-oriented programming (ROP) exploit, comprising:
- appending a dummy instruction to the end of a suspected ROP chain;
- executing the suspected ROP chain;
- determining that the dummy instruction was executed;
- and
- designating the suspected ROP chain as an ROP chain.
Dependencies are inferred from the claim text.