一句话：提出 STI 策略及基于 ARM 指针认证的 RSTI 机制，在运行时约束指针的类型与作用域以防御控制流与数据流攻击。
控制流劫持与面向数据攻击日益复杂，其中面向数据攻击可导致 SSL 密钥泄露等严重威胁；由于数据指针数量庞大，防御代价高。其根源在于指针被以非预期方式使用，违反原作用域或声明类型。本文提出 Scope Type Integrity (STI) 策略，要求所有代码与数据指针符合程序员意图，并设计 Runtime Scope Type Integrity (RSTI) 机制，利用 ARM Pointer Authentication 在运行时强制执行 STI：STI 收集指针的作用域、类型与权限信息，RSTI 据此验证指针使用的合法性。作者实现三种 RSTI 防御机制，在安全与性能间提供不同权衡，并在多种基准和真实应用上评估；三者开销分别为 5.29%、2.97% 和 11.12%。
Control-flow hijacking and data-oriented attacks are becoming more sophisticated. These attacks, especially data-oriented attacks, can result in critical security threats, such as leaking an SSL key. Data-oriented attacks are hard to defend against with acceptable performance due to the sheer amount of data pointers present. The root cause of such attacks is using pointers in unintended ways; fundamentally, these attacks rely on abusing pointers to violate the original scope they were used in or the original types that they were declared as. This paper proposes Scope Type Integrity (STI), a new defense policy that enforces all pointers (both code and data pointers) to conform to the original programmer's intent, as well as Runtime Scope Type Integrity (RSTI) mechanisms to enforce STI at runtime leveraging ARM Pointer Authentication. STI gathers information about the scope, type, and permissions of pointers. This information is then leveraged by RSTI to ensure pointers are legitimately utilized at runtime. We implemented three defense mechanisms of RSTI, with varying levels of security and performance tradeoffs to showcase the versatility of RSTI. We employ these three variants on a variety of benchmarks and real-world applications for a full security and performance evaluation of these mechanisms. Our results show that they have overheads of 5.29%, 2.97%, and 11.12%, respectively.
@inproceedings{IsmailJJMX24,
title = {Enforcing C/C++ Type and Scope at Runtime for Control-Flow and Data-Flow Integrity},
author = {Mohannad Ismail and Christopher Jelesnianski and Yeongjin Jang and Changwoo Min and Wenjie Xiong},
booktitle = {ASPLOS},
year = {2024},
doi = {10.1145/3620666.3651342}
}