Penetrating Shields: A Systematic Analysis of Memory Corruption Mitigations in the Spectre Era

TL;DR

This paper systematically analyzes the interplay between memory corruption mitigations and speculative execution vulnerabilities, revealing vulnerabilities and demonstrating proof-of-concept attacks on existing defenses.

Contribution

It introduces a taxonomy of memory corruption mitigations, identifies vulnerabilities, and develops a graph-based model to analyze and improve defenses against speculative attacks.

Findings

10 out of 20 defenses are likely vulnerable

Developed a graph-based analysis model for defenses

Demonstrated proof-of-concept attacks on existing mitigations

Abstract

This paper provides the first systematic analysis of a synergistic threat model encompassing memory corruption vulnerabilities and microarchitectural side-channel vulnerabilities. We study speculative shield bypass attacks that leverage speculative execution attacks to leak secrets that are critical to the security of memory corruption mitigations (i.e., the shields), and then use the leaked secrets to bypass the mitigation mechanisms and successfully conduct memory corruption exploits, such as control-flow hijacking. We start by systematizing a taxonomy of the state-of-the-art memory corruption mitigations focusing on hardware-software co-design solutions. The taxonomy helps us to identify 10 likely vulnerable defense schemes out of 20 schemes that we analyze. Next, we develop a graph-based model to analyze the 10 likely vulnerable defenses and reason about possible countermeasures. Finally, we present three proof-of-concept attacks targeting an already-deployed mitigation mechanism and two state-of-the-art academic proposals.