Immunizing binary executables against return-oriented programming

Abstract

Despite the numerous prevention and protection mechanisms that have been introduced into modern operating systems, the exploitation of memory corruption vulnerabilities still represents a serious threat to the security of software systems and networks. A recent exploitation technique, called Return-Oriented Programming (ROP), has lately attracted a considerable attention from academia. ROP attacks utilize short code sequences each ending with a free-branch instruction, i.e. an instruction that allows the attacker to control the execution flow. Identifying such sequences, or gadgets, available in binary executables and chaining them together, it is possible to perform arbitrary computations. Past research on the topic has mostly focused on refining the original attack technique, or on proposing partial solutions that target only particular variants of the attack. In this work, we present a compiler-based approach that represents the first practical solution against any possible form of ROP. Our solution is able to protect the aligned free-branch instructions to prevent them from being misused by an attacker, and to eliminate all unaligned free-branch instructions inside a binary executable. We developed a prototype based on our approach for the x86 architecture, and evaluated it by compiling GNU libc and a number of real-world applications. The results of the experiments demonstrate that our solution is able to prevent any form of returnoriented programming attack.