Proceedings of ISP RAS


Fine-grained address space layout randomization on program load

Nurmukhametov A.R. (ISP RAS, Moscow, Russia)
Zhabotinskiy E.A. (ISP RAS, Moscow, Russia)
Kurmangaleev Sh. F. (ISP RAS, Moscow, Russia)
Gaissaryan S.S. (ISP RAS, Moscow, Russia; MSU, Moscow, Russia; MIPT, Dolgoprudny, Moscow Region, Russia; HSE, Moscow, Russia)
Vishnyakov A.V. (ISP RAS, Moscow, Russia)

Abstract

Program vulnerabilities are a serious security threat. It is important to develop defenses preventing their exploitation, especially with a rapid increase of ROP attacks. State of the art defenses have some drawbacks that can be used by attackers. In this paper we propose fine-grained address space layout randomization on program load that is able to protect from such kind of attacks. During the static linking stage executable and library files are supplemented with information about function boundaries and relocations. A system dynamic linker/loader uses this information to perform functions permutation. The proposed method was implemented for 64-bit programs on CentOS 7 operating system. The implemented method has shown good resistance to ROP attacks based on two metrics: the number of survived gadgets and the exploitability estimation of ROP chain examples. The implementation presented in this article is applicable across the entire operating system and has shown 1.5 % time overhead. The working capacity of proposed approach was demonstrated on real programs. The further research can cover forking randomization and finer granularity than on the function level. It also makes sense to implement the randomization of short functions placement, taking into account the relationships between them. The close arrangement of functions that often call each other can improve the performance of individual programs.

Keywords

address space layout randomization; diversification, ASLR; ROP

Edition

Proceedings of the Institute for System Programming, vol. 29, issue 6, 2017, pp. 163-182.

ISSN 2220-6426 (Online), ISSN 2079-8156 (Print).

DOI: 10.15514/ISPRAS-2017-29(6)-9

Full text of the paper in pdf (in Russian) Back to the contents of the volume