Hafix

Abstract

Code-reuse attacks like return-oriented programming (ROP) pose a severe threat to modern software on diverse processor architectures. Designing practical and secure defenses against code-reuse attacks is highly challenging and currently subject to intense research. However, no secure and practical system-level solutions exist so far, since a large number of proposed defenses have been successfully bypassed. To tackle this attack, we present HAFIX (Hardware-Assisted Flow Integrity eXtension), a defense against code-reuse attacks exploiting backward edges (returns). HAFIX provides fine-grained and practical protection, and serves as an enabling technology for future control-flow integrity instantiations. This paper presents the implementation and evaluation of HAFIX for the Intel Siskiyou Peak and SPARC embedded system architectures, and demonstrates its security and efficiency in code-reuse protection while incurring only 2% performance overhead.

CFI CaRE: Hardware-Supported Call and Return Enforcement for Commercial Microcontrollers

“…We implemented a proof-of-concept prototype of CaRE on the ARM Versatile Express Cortex-M Prototyping System MPS2+ configured as a Cortex-M23 CPU. 15 .…”

“…An important feature of M-class cores is their deterministic interrupt latency in part attributable to the fact that the context-switch, while entering the exception handler, is performed entirely in hardware. An instruction that triggers an exception, such as the svc used for supervisor calls, causes 1) the hardware to save the current execution context state onto a stack 15 We also tested our prototype on the CMSDK_ARMv8MBL FastModel emulator pointed to by one of the sp registers, 2) the ipsr to be updated with the number of the taken exception, and 3) the processor to switch into Handler mode in which exceptions are taken. Table 4 shows the layout of a typical stack frame created during exception entry 17 .…”

“…AVRAND by Pastrana et al [44] constitutes a software-based defense against code reuse attacks for AVR devices. HAFIX [15] is a hardware-based CFI solution for the Intel Siskiyou Peak and SPARC embedded system architectures.…”

“…Countermeasures for general purpose computing devices, such as ASLR, often rely on hardware features (e.g., virtual memory) that are unavailable in simple MCUs. Prior CFI schemes for embedded systems, such as HAFIX [15], and the recently announced Intel Control-flow Enforcement Technology (CET) [31], require changes to the hardware and toolchain, access to source code and do not support interrupts.…”

A case against indirect jumps for secure programs

“…In addition to the instructions, the processor needs the metadata defining a complete CFG. Some solutions such as HAFIX [5] or CHERI [18] propose to enrich the instruction set architecture (ISA) semantic with new instructions, embedding the metadata in the instructions themselves.…”