Abstract
Although many defense mechanisms against buffer overflow attacks have been proposed, buffer overflow vulnerability in software is still one of the most prevalent vulnerabilities exploited. This paper proposes a micro-architecture based defense mechanism against buffer overflow attacks. As buffer overflow attack leads to a compromised return address, our approach is to provide a software transparent micro-architectural support for return address integrity checking. By keeping an uncompromised copy of the return address separate from the activation record in run-time stack, the return address compromised by a buffer overflow attack can be detected at run time. Since extra copies of return addresses are already found in the return address stack (RAS) for return address prediction in most high-performance microprocessors, this paper considers augmenting the RAS in speculative superscalar processors for return address integrity checking. The new mechanism provides 100% accurate return address prediction as well as integrity checking for return addresses. Hence, it enhances system performance in addition to preventing a buffer overflow attack.
| Original language | English |
|---|---|
| Title of host publication | 2004 Computing Frontiers Conference |
| Pages | 335-342 |
| Number of pages | 8 |
| Publication status | Published - 2004 Aug 30 |
| Externally published | Yes |
| Event | 2004 Computing Frontiers Conference - Ischia, Italy Duration: 2004 Apr 14 → 2004 Apr 16 |
Other
| Other | 2004 Computing Frontiers Conference |
|---|---|
| Country | Italy |
| City | Ischia |
| Period | 04/4/14 → 04/4/16 |
Fingerprint
Keywords
- Buffer overflow
- Computer architecture
- Computer security
- Intrusion tolerance
ASJC Scopus subject areas
- Engineering(all)
Cite this
Repairing return address stack for buffer overflow protection. / Park, Yong Joon; Lee, Kyung Ho.
2004 Computing Frontiers Conference. 2004. p. 335-342.Research output: Chapter in Book/Report/Conference proceeding › Conference contribution
}
TY - GEN
T1 - Repairing return address stack for buffer overflow protection
AU - Park, Yong Joon
AU - Lee, Kyung Ho
PY - 2004/8/30
Y1 - 2004/8/30
N2 - Although many defense mechanisms against buffer overflow attacks have been proposed, buffer overflow vulnerability in software is still one of the most prevalent vulnerabilities exploited. This paper proposes a micro-architecture based defense mechanism against buffer overflow attacks. As buffer overflow attack leads to a compromised return address, our approach is to provide a software transparent micro-architectural support for return address integrity checking. By keeping an uncompromised copy of the return address separate from the activation record in run-time stack, the return address compromised by a buffer overflow attack can be detected at run time. Since extra copies of return addresses are already found in the return address stack (RAS) for return address prediction in most high-performance microprocessors, this paper considers augmenting the RAS in speculative superscalar processors for return address integrity checking. The new mechanism provides 100% accurate return address prediction as well as integrity checking for return addresses. Hence, it enhances system performance in addition to preventing a buffer overflow attack.
AB - Although many defense mechanisms against buffer overflow attacks have been proposed, buffer overflow vulnerability in software is still one of the most prevalent vulnerabilities exploited. This paper proposes a micro-architecture based defense mechanism against buffer overflow attacks. As buffer overflow attack leads to a compromised return address, our approach is to provide a software transparent micro-architectural support for return address integrity checking. By keeping an uncompromised copy of the return address separate from the activation record in run-time stack, the return address compromised by a buffer overflow attack can be detected at run time. Since extra copies of return addresses are already found in the return address stack (RAS) for return address prediction in most high-performance microprocessors, this paper considers augmenting the RAS in speculative superscalar processors for return address integrity checking. The new mechanism provides 100% accurate return address prediction as well as integrity checking for return addresses. Hence, it enhances system performance in addition to preventing a buffer overflow attack.
KW - Buffer overflow
KW - Computer architecture
KW - Computer security
KW - Intrusion tolerance
UR - http://www.scopus.com/inward/record.url?scp=4143130038&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=4143130038&partnerID=8YFLogxK
M3 - Conference contribution
AN - SCOPUS:4143130038
SN - 1581137419
SN - 9781581137415
SP - 335
EP - 342
BT - 2004 Computing Frontiers Conference
ER -