Back to results
US 9,177,148 B2Granted
Protection against return oriented programming attacks
AssigneeIntel Corporation
InventorStephen A. Fischer
Life of this patent
Estimating the term…
Abstract
In one embodiment, a processor includes at least one execution unit. The processor also includes a Return Oriented Programming (ROP) logic coupled to the at least one execution unit. The ROP logic may validate a return pointer stored on a call stack based on a secret ROP value. The secret ROP value may only be accessible by the operating system.
Claims16
A processor comprising:
- a plurality of hardware cores each to execute instructions, each of the plurality of hardware cores including a Return Oriented Programming (ROP) hardware logic to:
- obtain a secret value and a check value stored on a call stack, wherein the ROP hardware logic is to generate the check value responsive to a call instruction to push a return pointer onto the call stack and call a routine, wherein the secret value is encrypted with the return pointer or a stack pointer to generate the check value and the ROP hardware logic is to control a strength of the secret value according to a ROP security level;
- determine that the return pointer is part of a ROP attack based on a determination that the check value was not generated based on the secret value;
- and
- prevent execution of a return to a first function when the return pointer is determined to be part of the ROP attack.
2 more elements
A system comprising:
- at least one processor to execute a check return instruction of an instruction set architecture (ISA) to:
- pop a return pointer and a check value off a call stack;
- determine whether the check value is based on a secret Return Oriented Programming (ROP) value, wherein the secret ROP value is encrypted with the return pointer or a stack pointer and a strength of the secret ROP value is to be controlled based on a ROP security level;
- in response to a determination that the check value is not based on the secret ROP value, determine that the return pointer is part of a ROP attack and prevent execution of a return to a first function;
- and
- a dynamic random access memory (DRAM) coupled to the at least one processor.
3 more elements
A non-transitory machine-readable medium having stored thereon instructions, which if performed by a machine cause the machine to perform a method comprising:
- obtaining a check value and a return pointer from a call stack stored in a memory, wherein the check value is associated with the return pointer;
- determining whether the check value is valid based on a secret Return Oriented Programming (ROP) value, wherein the secret ROP value is encrypted with the return pointer or a stack pointer, wherein a strength of the secret ROP value is controlled based on a ROP security level;
- and
- in response to determining that the check value is not based on the secret ROP value, determining that the return pointer is part of a ROP attack and preventing execution of a return to a first function.
1 more element
Dependencies are inferred from the claim text.