Protecting C++ Dynamic Dispatch Through VTable Interleaving

Abstract

With new defenses against traditional control-flow attacks like stack buffer overflows, attackers are increasingly using more advanced mechanisms to take control of execution. One common such attack is vtable hijacking, in which the attacker exploits bugs in C++ programs to overwrite pointers to the virtual method tables (vtables) of objects. We present a novel defense against this attack. The key insight of our approach is a new way of laying out vtables in memory through careful ordering and interleaving. Although this layout is very different from a traditional layout, it is backwards compatible with the traditional way of performing dynamic dispatch. Most importantly, with this new layout, checking the validity of a vtable at runtime becomes an efficient range check, rather than a set membership test. Compared to prior approaches that provide similar guarantees, our approach does not use any profiling information, has lower performance overhead (about 1%) and has lower code bloat overhead (about 1.7%). Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

SoK: Shining Light on Shadow Stacks

“…CFI mechanisms work by using static analysis to create an over approximation of the control-flow graph (CFG), and then enforce at runtime that all transitions must be within the statically computed CFG. After the initial proposal, follow on research has removed the need for whole program analysis [57], [58], and specialized CFI to use additional information in C++ programs when protecting virtual calls [59], [60]. To improve the precision of the CFG construction underlying CFI, more advanced static analysis techniques have been proposed [61].…”

SAVI objects: sharing and virtuality incorporated

“…A lot of work has been done on security implications of how dynamic dispatch is implemented [Borchert and Spinczyk 2016;Bounov et al 2016;Dewey and Giffin 2012;Elsabagh et al 2017;Gawlik and Holz 2014;Haller et al 2015;Jang et al 2014;Miller et al 2014;Prakash et al 2015;Sarbinowski et al 2016;Tice et al 2014;Zhang et al , 2016Zixiang et al 2016]. Our work is concerned with object sharing, but security implications would be interesting to study.…”

NoJITsu: Locking Down JavaScript Engines

“…While their attack targets similar components to ours, these two attacks are conceptually different. The PS Vita attack is based on a well-known COOP-style attack which overwrites object's virtual function table (vtable) pointer with a pointer to a fake vtable [51], and thus this attack would be prevented by existing defenses against vtable corruption or vtable reuse attacks [14], [24], [67]. In contrast, our attack deliberately overwrites the internal data of a JavaScript object (not the vtable pointers of any objects with virtual methods) to invoke a chosen function; in fact, this manipulates how the bytecode interpreter interprets the corrupted JavaScript object.…”