破坏和修复破坏性代码读取防御
Breaking and Fixing Destructive Code Read Defenses
摘要：
即时返回导向编程（JIT-ROP）是一种强大的内存破坏攻击，它绕过了各种形式的代码随机化。只执行内存（XOM）可以防止这些攻击，但需要源代码。相反，破坏性代码读取（DCR）提供了安全性和遗留兼容性之间的折衷。通常认为，如果与高熵代码随机化相结合，DCR可以提供强大的保护。本文的贡献是双重的：首先，我们证明了DCR可以被绕过，无论潜在的代码随机化方案。为此，我们展示了新颖的，通用的攻击，推断高度随机化的程序代码的代码布局。其次，我们提出了BGDX（字节粒度DCR和XOM），一种新的缓解技术，保护传统的二进制代码推理攻击的设计和实现。BGDX在字节粒度级别上强制执行内存权限，允许我们将DCR和XOM结合起来用于传统的现成二进制文件。我们的评估表明，BGDX不仅是有效的，但效率很高，施加的几何平均性能开销仅为3.95%的SPEC。
英文摘要：
Just-in-time return-oriented programming (JIT-ROP) is a powerful memory corruption attack that bypasses various forms of code randomization. Execute-only memory (XOM) can potentially prevent these attacks, but requires source code. In contrast, destructive code reads (DCR) provide a trade-off between security and legacy compatibility. The common belief is that DCR provides strong protection if combined with a high-entropy code randomization. The contribution of this paper is twofold: first, we demonstrate that DCR can be bypassed regardless of the underlying code randomization scheme. To this end, we show novel, generic attacks that infer the code layout for highly randomized program code. Second, we present the design and implementation of BGDX (Byte-Granular DCR and XOM), a novel mitigation technique that protects legacy binaries against code inference attacks. BGDX enforces memory permissions on a byte-granular level allowing us to combine DCR and XOM for legacy, off-the-shelf binaries. Our evaluation shows that BGDX is not only effective, but highly efficient, imposing only a geometric mean performance overhead of 3.95% on SPEC.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
