PAC it up: Towards Pointer Integrity using ARM Pointer Authentication

Liljestrand, Hans; Nyman, Thomas; Wang, Kui; Perez, Carlos Chinea; Ekberg, Jan-Erik; Asokan, N.

doi:10.48550/arxiv.1811.09189

Cited by 2 publications

(11 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Due to lack of publicly available PA-capable hardware we have used an evaluation approach similar to prior work [8,9]. We used the ARMv8-A Base Platform Fixed Virtual Platform (FVP), based on Fast Models 11.5, which supports ARMv8.3-A for functional evaluation.…”

Section: Discussionmentioning

confidence: 99%

“…Signed return addresses provides similar protection to stack canaries, i.e., if a stack-buffer overflow corrupts the return address, this is detected when the return address is verified before returning from a function (Figure 3). However, PA is vulnerable to reuse attacks where previously encountered signed pointers can be used to used to replace latter signed pointers using the same key and modifier [9]. For instance, -msign-return-address can be circumvented by reusing a prior return address signed using the same SP value.…”

Section: Armv8-a Pointer Authenticationmentioning

confidence: 99%

“…PA-based return-address protection [8,9,14] already effectively serves as a canary by detecting return-address corruption. We therefore propose a design that can be efficiently and easily integrated with existing return-address protection schemes, but also provide a stand-alone setup.…”

Section: Pa-based Canariesmentioning

confidence: 99%

“…The recently introduced ARMv8.3-A pointer authentication (PA) [1] hardware can be used to verify return addresses [14], effectively turning the return address itself into a stack canary. However, PA on its own is susceptible to reuse attacks, where an attacker substitutes one authenticated pointer with another [9]. State-of-the-art schemes harden A stack canary is a value placed on the stack so that it will be overwritten by a stack buffer that overflows to the return address.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Protecting the stack with PACed canaries

Liljestrand

Gauhar

Nyman

et al. 2019

Proceedings of the 4th Workshop on System Software for Trusted Execution

Self Cite

View full text Add to dashboard Cite

Stack canaries remain a widely deployed defense against memory corruption attacks. Despite their practical usefulness, canaries are vulnerable to memory disclosure and brute-forcing attacks. We propose PCan, a new approach based on ARMv8.3-A pointer authentication (PA), that uses dynamically-generated canaries to mitigate these weaknesses and show that it provides more fine-grained protection with minimal performance overhead.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Armv8-a Pointer Authenticationmentioning

confidence: 99%

Section: Pa-based Canariesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Protecting the stack with PACed canaries

Liljestrand

Gauhar

Nyman

et al. 2019

Proceedings of the 4th Workshop on System Software for Trusted Execution

Self Cite

View full text Add to dashboard Cite

show abstract

“…One initial use case of PA is the signing and verification of return addresses [39]. However, current PA schemes are vulnerable to reuse attacks, where the adversary can reuse previously observed valid protected pointers [31]. Prior work [31,39] and current implementations by GCC 1 and LLVM 2 mitigate reuse attacks, but cannot completely prevent them.…”

Section: Introductionmentioning

confidence: 99%

Authenticated Call Stack

Liljestrand

Nyman

Ekberg

et al. 2019

Proceedings of the 56th Annual Design Automation Conference 2019

Self Cite

View full text Add to dashboard Cite

A popular run-time attack technique is to compromise the controlflow integrity of a program by modifying function return addresses on the stack. So far, shadow stacks have proven to be essential for comprehensively preventing return address manipulation. Shadow stacks record return addresses in integrity-protected memory, secured with hardware-assistance or software access control. Software shadow stacks incur high overheads or trade off security for efficiency. Hardware-assisted shadow stacks are efficient and secure, but require the deployment of special-purpose hardware.We present authenticated call stack (ACS), an approach that uses chained message authentication codes (MACs) to achieve comparable security without requiring additional hardware support. We present PACStack, a realization of ACS on the ARMv8.3-A architecture, using its general purpose hardware mechanism for pointer authentication (PA). Via a rigorous security analysis, we show that PACStack achieves security comparable to hardware-assisted shadow stacks without requiring dedicated hardware. We demonstrate that PACStack's performance overhead is negligible (<1%). 1 https://gcc.gnu.org/onlinedocs/gcc/AArch64-Function-Attributes.html 2 https://reviews.llvm.org/D49793 1

show abstract

PAC it up: Towards Pointer Integrity using ARM Pointer Authentication

Cited by 2 publications

References 24 publications

Protecting the stack with PACed canaries

Protecting the stack with PACed canaries

Authenticated Call Stack

Contact Info

Product

Resources

About