Protecting the stack with PACed canaries

TL;DR

This paper introduces PCan, a novel canary protection method leveraging ARMv8.3-A pointer authentication to enhance security against memory disclosure and brute-force attacks with minimal performance impact.

Contribution

It presents a new canary scheme using pointer authentication, providing more fine-grained security and addressing vulnerabilities of traditional stack canaries.

Findings

PCan effectively mitigates memory disclosure attacks.

It introduces minimal performance overhead.

Provides stronger protection compared to traditional canaries.

Abstract

Stack canaries remain a widely deployed defense against memory corruption attacks. Despite their practical usefulness, canaries are vulnerable to memory disclosure and brute-forcing attacks. We propose PCan, a new approach based on ARMv8.3-A pointer authentication (PA), that uses dynamically-generated canaries to mitigate these weaknesses and show that it provides more fine-grained protection with minimal performance overhead.