Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization

By Kevin Z. Snow, Fabian Monrose, Lucas Davi, Alexandra Dmitrienko, Christopher Liebchen, Ahmad-Reza Sadeghi. IEEE Symposium on Security and Privacy, 2013

590 citations recorded by the source corpus.

Fine-grained address space layout randomization (ASLR) has recently been proposed as a method of efficiently mitigating runtime attacks. In this paper, we introduce the design and implementation of a framework based on a novel attack strategy, dubbed just-in-time code reuse, that undermines the benefits of fine-grained ASLR. Specifically, we derail the assumptions embodied in fine-grained ASLR by exploiting the ability to repeatedly abuse a memory disclosure to map an application's memory layout on-the-fly, dynamically discover API functions and gadgets, and JIT-compile a target program using those gadgets -- all within a script environment at the time an exploit is launched. We demonstrate the power of our framework by using it in conjunction with a real-world exploit against Internet Explorer, and also provide extensive evaluations that demonstrate the practicality of just-in-time code reuse attacks. Our findings suggest that fine-grained ASLR may not be as promising as first thought.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/5fa8d1a53032c2be88945fdf0e242b65c3d74764

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

The Cybersecurity Landscape in Industrial Control Systems (2016, background): “However, a recent just-in-time return-oriented programming (JIT-ROP) attack, circumvents fine-grained ASLR by finding gadgets and generating the returnoriented payload on the fly [121].”
ROP is Still Dangerous: Breaking Modern Defenses (2014, methodology): “A recent just-in-time code reuse attack [29] compiles ROP on the fly to bypass ASLR.”
Code-pointer integrity (2014, background): “, memory corruption bugs [45] or side channel attacks [22].”
Data-Oriented Programming: On the Expressiveness of Non-control Data Attacks (2016, background): “ROP technique and its variants have been extensively explored recently [1]–[5], [23], [61], [62].”
SGX-Shield: Enabling Address Space Layout Randomization for SGX Programs (2017, background): “Similarly, with an arbitrary memory read, attackers can infer the complete address space layout by following the pointers and instructions from the initial information found in the SSA frame, similar to just-in-time code reuse [57].”
Jump over ASLR: Attacking branch predictors to bypass ASLR (2016, methodology): “[64] presented just-in-time code reuse attack as an effective technique against sophisticated fine-grained randomization schemes.”
Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications (2015, background): “The implementation of an inherited virtual function may be overridden in a derived class.”
PlatPal: Detecting Malicious Documents with Platform Diversity (2017, methodology): “platform, or even generating ROP payload dynamically using techniques like JIT-ROP [49].”
Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection (2014, background): “Memory disclosure can even be exploited to circumvent fine-grained ASLR schemes, where the location of each code block is randomized in memory by identifying ROP gadgets on-thefly and generating a ROP payload at runtime [36].”
SGXBOUNDS: Memory Safety for Shielded Execution (2017, background): “claves (recall that SGX restricts enclave address space to only 36 bits) and thus can be easily broken [70, 72].”
Out of Control: Overcoming Control-Flow Integrity (2014, methodology): “Again, in the presence of powerful exploits that can arbitrarily leak memory, it has been shown that fine grained randomization techniques fail in protecting the vulnerable program [5].”
ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks (2014, background): “The adversary can launch the stack pivoting attack [29] to evade ROPecker detection.”
Control Flow Integrity for COTS Binaries (2013, background): “Moreover, just-in-time code reuse attacks [39] discover gadgets using repeated information leakage attacks and are able to defeat even fine-grained code randomization.”
C-FLAT: Control-Flow Attestation for Embedded Systems Software (2016, background): “C-FLAT is able to detect return-oriented programming (including just-in-time return-oriented programming [40]) since unknown control-flow edges are taken upon execution of a return.”