Using Name Confusion to Enhance Security

by   Mohamed Tarek Ibn Ziad, et al.

Virtual memory is an abstraction that assigns references, or names, to data objects and instructions. Typically, instructions have exactly one name: a uniquely-identifiable virtual address. This mapping can be leveraged by adversaries to deterministically construct exploit payloads. In this work, we investigate how virtual memory should be redesigned to eliminate the need for this one-to-one mapping, effectively increasing system security. Our solution, Name Confusion, provides multiple names (i.e.,virtual addresses) for an instruction. This allows us to define a security protocol, namely Phantom Name System (PNS), in which the order of names used during execution can be randomized. It works as follows: during instruction fetch, the address (name) used to fetch an instruction is randomly chosen, and from that point on, any PC-relative addresses use the name obtained during the fetch. PNS can be used to mitigate a class of attacks known as code-reuse attacks by significantly reducing the success probability of an exploit payload. If an attacker causes any of the PC-relative addresses to be different from the one chosen during the fetch, the program will crash. PNS provides a new security feature that requires minor microarchitectural adjustments, and can be combined with other security features to enhance their strength. Lastly, we show that our performance is better than commercially-available state-of-the-art hardware primitives, e.g., cryptographic CFI, by a significant margin.


Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models

Instruction-tuned models are trained on crowdsourcing datasets with task...

Modal Abstractions for Virtualizing Memory Addresses

Operating system kernels employ virtual memory management (VMM) subsyste...

Survey of Methods for Automated Code-Reuse Exploit Generation

This paper provides a survey of methods and tools for automated code-reu...

Understanding Evolutionary Potential in Virtual CPU Instruction Set Architectures

We investigate fundamental decisions in the design of instruction set ar...

Decanting the Contribution of Instruction Types and Loop Structures in the Reuse of Traces

Reuse has been proposed as a microarchitecture-level mechanism to reduce...

BasicBlocker: Redesigning ISAs to Eliminate Speculative-Execution Attacks

Recent research has revealed an ever-growing class of microarchitectural...

Contract-Aware Secure Compilation

Microarchitectural attacks exploit the abstraction gap between the Instr...

Please sign up or login with your details

Forgot password? Click here to reset