Graduate School and Research Center In communication systems

G-Free : defeating return-oriented programming through gadget-less binaries

Onarlioglu, Kaan; Bilge, Leyla; Lanzi, Andrea; Balzarotti, Davide; Kirda, Engin

ACSAC 2010, Annual Computer Security Applications Conference, December 6-10, 2010, Austin, Texas, USA

Despite the numerous prevention and protection mechanisms that have been introduced into modern operating systems, the exploitation of memory corruption vulnerabilities still represents a serious threat to the security of software systems and networks. A recent exploitation technique, called Return-Oriented Programming (ROP), has lately attracted a considerable attention from academia. Past research on the topic has mostly focused on refining the original attack technique, or on proposing partial solutions that target only particular variants of the attack. In this paper, we present G-Free, a compiler-based approach that represents the first practical solution against any possible form of ROP. Our solution is able to eliminate all unaligned free-branch instructions inside a binary executable, and to protect the aligned free-branch instructions to prevent them from being misused by an attacker. We developed a prototype based on our approach, and evaluated it by compiling GNU libc and a number of real-world applications. The results of the experiments show that our solution is able to prevent any form of return-oriented programming.  

Document Doi Bibtex

Keywords:Return-oriented programming, ROP, return-to-libc
Type:Conference
Language:English
City:Austin
Country:UNITED STATES
Date:
Department:Networking and Security
Eurecom ref:3235
Copyright: © ACM, 2010. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in ACSAC 2010, Annual Computer Security Applications Conference, December 6-10, 2010, Austin, Texas, USA http://dx.doi.org/10.1145/1920261.1920269
Bibtex: @inproceedings{EURECOM+3235, doi = {http://dx.doi.org/10.1145/1920261.1920269 }, year = {2010}, title = {{G}-{F}ree : defeating return-oriented programming through gadget-less binaries}, author = {{O}narlioglu, {K}aan and {B}ilge, {L}eyla and {L}anzi, {A}ndrea and {B}alzarotti, {D}avide and {K}irda, {E}ngin}, booktitle = {{ACSAC} 2010, {A}nnual {C}omputer {S}ecurity {A}pplications {C}onference, {D}ecember 6-10, 2010, {A}ustin, {T}exas, {USA}}, address = {{A}ustin, {UNITED} {STATES}}, month = {12}, url = {http://www.eurecom.fr/publication/3235} }
See also: