Using Name Confusion to Enhance Security
share
Virtual memory is an abstraction that assigns references, or names, to data objects and instructions. Typically, instructions have exactly one name: a uniquely-identifiable virtual address. This mapping can be leveraged by adversaries to deterministically construct exploit payloads. In this work, we investigate how virtual memory should be redesigned to eliminate the need for this one-to-one mapping, effectively increasing system security. Our solution, Name Confusion, provides multiple names (i.e.,virtual addresses) for an instruction. This allows us to define a security protocol, namely Phantom Name System (PNS), in which the order of names used during execution can be randomized. It works as follows: during instruction fetch, the address (name) used to fetch an instruction is randomly chosen, and from that point on, any PC-relative addresses use the name obtained during the fetch. PNS can be used to mitigate a class of attacks known as code-reuse attacks by significantly reducing the success probability of an exploit payload. If an attacker causes any of the PC-relative addresses to be different from the one chosen during the fetch, the program will crash. PNS provides a new security feature that requires minor microarchitectural adjustments, and can be combined with other security features to enhance their strength. Lastly, we show that our performance is better than commercially-available state-of-the-art hardware primitives, e.g., cryptographic CFI, by a significant margin.
READ FULL TEXT