DeckerPlus: Whole Program Attack Surface Reduction via Compiler Analysis and Transformations
Modern code reuse attacks take full advantage of bloated software. Attackers piece together short sequences of instructions in otherwise benign code to carry out malicious actions. Mitigating these reusable code snippets, known as gadgets, has become one of the prime focuses of attack surface reduction research. While some debloating techniques remove parts of software that contain such gadgets, other methods focus on making them unusable by breaking up chains of them, thereby substantially diminishing the possibility of code reuse attacks. Due to a high number of vulnerabilities, third-party libraries (such as glibc) used to be the main focus of this research but recently the scope of such attacks have enlarged to whole programs and thus, the techniques have emerged that deal with whole applications. Attack surface reduction efforts have typically tried to eliminate such attacks by subsetting (debloating) the application, e.g. via user-specified inputs, configurations, However, such techniques suffer from limitations in soundness, i.e., the software might crash during normal executions on valid inputs, or they may be conservative and leave a large amount of attack surface untackled. In this work, we present a general, whole-program attack surface reduction technique called DeckerPlus that significantly reduces gadgets that are accessible to an attacker during an execution phase (called a deck) and has minor performance degradation. DeckerPlus requires no user inputs and leaves all features intact. It uses static analysis to determine key function sets that should be enabled/disabled at runtime. The runtime system enables these function sets at the specified program points during execution. We implement two extensions to improve the baseline technique utilizing function cloning and inlining. As a result, our baseline framework achieves 70.3% average total gadget reduction on SPEC CPU 2017, 88.5% on GNU coreutils, and 89.0% across the application workloads (nginx, Redis, lighttpd, and xpdf). Function cloning improves these reductions to 75.5%, 89.6%, and 94.2%, respectively, and inlining improves them further to 77.6%, 94.7%, and 97.8%. Overall, the baseline and extensions achieve these reductions with modest runtime overhead: average slowdown is 6.5% on SPEC CPU 2017, nginx averages 1.062x slowdown with baseline DeckerPlus and 1.011x with inlining, Redis throughput is essentially unchanged, lighttpd remains close to baseline throughput, and GNU coreutils overhead is negligible. In addition, we provide a gadget chain-breaking case study, including detailed JOP gadget metrics on both Linux and Windows, and show that our framework breaks the shell-spawning chain in all cases.