Stack integrity for practical code-reuse attack defense

Defensive Capability Analysis for JavaScript Libraries

Defensive Capability Analysis for JavaScript Libraries

Heatseeker: Uncovering Dispatcher Gadgets on the Fly

The heatseeker algorithm is presented, an innovative signature-based detection algorithm specifically designed to identify JOP attacks by analyzing patterns during program execution, offering robust protection without impacting performance.

DeckerPlus: Whole Program Attack Surface Reduction via Compiler Analysis and Transformations

Modern code reuse attacks take full advantage of bloated software. Attackers piece together short sequences of instructions in otherwise benign code to carry out malicious actions. Mitigating these reusable code snippets, known as gadgets, has become one of the prime focuses of attack surface reduction research. While some debloating techniques remove parts of software that contain such gadgets, other methods focus on making them unusable by breaking up chains of them, thereby substantially diminishing the possibility of code reuse attacks. Due to a high number of vulnerabilities, third-party libraries (such as glibc) used to be the main focus of this research but recently the scope of such attacks have enlarged to whole programs and thus, the techniques have emerged that deal with whole applications. Attack surface reduction efforts have typically tried to eliminate such attacks by subsetting (debloating) the application, e.g. via user-specified inputs, configurations, However, such techniques suffer from limitations in soundness, i.e., the software might crash during normal executions on valid inputs, or they may be conservative and leave a large amount of attack surface untackled. In this work, we present a general, whole-program attack surface reduction technique called DeckerPlus that significantly reduces gadgets that are accessible to an attacker during an execution phase (called a deck) and has minor performance degradation. DeckerPlus requires no user inputs and leaves all features intact. It uses static analysis to determine key function sets that should be enabled/disabled at runtime. The runtime system enables these function sets at the specified program points during execution. We implement two extensions to improve the baseline technique utilizing function cloning and inlining. As a result, our baseline framework achieves 70.3% average total gadget reduction on SPEC CPU 2017, 88.5% on GNU coreutils, and 89.0% across the application workloads (nginx, Redis, lighttpd, and xpdf). Function cloning improves these reductions to 75.5%, 89.6%, and 94.2%, respectively, and inlining improves them further to 77.6%, 94.7%, and 97.8%. Overall, the baseline and extensions achieve these reductions with modest runtime overhead: average slowdown is 6.5% on SPEC CPU 2017, nginx averages 1.062x slowdown with baseline DeckerPlus and 1.011x with inlining, Redis throughput is essentially unchanged, lighttpd remains close to baseline throughput, and GNU coreutils overhead is negligible. In addition, we provide a gadget chain-breaking case study, including detailed JOP gadget metrics on both Linux and Windows, and show that our framework breaks the shell-spawning chain in all cases.

Programming Language Standards and their impact on Memory Safety: C++, Rust and Python – A comparative study

This paper investigates how programming language standards influence memory safety by analyzing three distinct approaches: the manual memory management of C++, the ownership-based compile-time model of Rust, and the automatic garbage collection of Python.

CodeMechanic: Bug-Property-Guided Program Mitigation

This work presents CodeMechanic, a bug-property-guided system for generating constrained mit- igations for spatial memory corruption that combines a two-dimensional static and dynamic context extractor with in-prompt debugging knowledge and stepwise val- idation to limit the effect of LLM errors.