通过推测性控制流劫持实现存储器安全机制
Bypassing memory safety mechanisms through speculative control flow hijacks
摘要：
在过去的几十年中，内存损坏漏洞的流行导致了许多防御措施，如堆栈金丝雀，控制流完整性（CFI）和内存安全语言。这些防御可以防止整个类别的漏洞，并有助于提高程序的安全状态。在本文中，我们表明，内存损坏防御可以绕过使用投机执行攻击。我们研究了Go中的堆栈保护器，CFI和边界检查的情况，演示了在何种条件下它们可以通过一种形式的投机控制流劫持绕过，依赖于控制流数据的投机或架构重写。通过将受害者的推测控制流重定向到访问秘密数据并充当侧通道发送的小工具，信息被泄露。我们还首次证明，这可以通过将多个小工具拼接在一起来实现，这是一种投机性的面向回报的编程攻击。我们讨论并实施软件缓解措施，显示出中等的性能影响。
英文摘要：
The prevalence of memory corruption bugs in the past decades resulted in numerous defenses, such as stack canaries, control flow integrity (CFI), and memory safe languages. These defenses can prevent entire classes of vulnerabilities, and help increase the security posture of a program. In this paper, we show that memory corruption defenses can be bypassed using speculative execution attacks. We study the cases of stack protectors, CFI, and bounds checks in Go, demonstrating under which conditions they can be bypassed by a form of speculative control flow hijack, relying on speculative or architectural overwrites of control flow data. Information is leaked by redirecting the speculative control flow of the victim to a gadget accessing secret data and acting as a side channel send. We also demonstrate, for the first time, that this can be achieved by stitching together multiple gadgets, in a speculative return-oriented programming attack. We discuss and implement software mitigations, showing moderate performance impact.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
