Detection of return oriented programming attacks
View Patent ↗In one embodiment, a processor includes at least one execution unit and Return Oriented Programming (ROP) detection logic. The ROP detection logic may determine a ROP metric based on a plurality of control transfer events. The ROP detection logic may also determine whether the ROP metric exceeds a threshold. The ROP detection logic may also, in response to a determination that the ROP metric exceeds the threshold, provide a ROP attack notification.
1. A processor comprising:
a decode unit to decode instructions;
at least one execution unit to execute decoded instructions;
a retirement unit to retire executed instructions; and
a Return Oriented Programming (ROP) detection logic to:
increment a count in response to detection of a control transfer event of a first type and decrement the count in response to detection of a control transfer event of a second type,
determine whether the count exceeds a threshold, and
in response to a determination that the count exceeds the threshold, provide a ROP attack notification.
2. The processor of claim 1 , wherein the ROP detection logic comprises an accumulator to store the count.
3. The processor of claim 1 , wherein the ROP detection logic is to increment the count in response to an instance of a subroutine return instruction.
4. The processor of claim 3 , wherein the ROP detection logic is to decrement the count in response to an instance of a subroutine call instruction.
5. The processor of claim 1 , wherein the ROP detection logic is to increment the count in response to a return misprediction.
6. The processor of claim 1 , wherein the ROP detection logic is to increment the count in response to an instance of a control transfer instruction associated with a stack pop instruction.
7. The processor of claim 1 , wherein the ROP detection logic is to increment the count in response to an instance of a control transfer instruction associated with an increase in a stack pointer.
8. The processor of claim 1 , wherein the ROP attack notification is to trigger a protection application to take one or more actions to address the ROP attack.
9. The processor of claim 1 , wherein the ROP detection logic is further to freeze a branch instruction log in response to determination that the count exceeds the threshold.
10. A processor comprising:
an instruction buffer;
a branch prediction unit; and
a Return Oriented Programming (ROP) detection unit comprising:
an accumulator to generate a count based on detection of a plurality of types of control transfer events, the accumulator to increment the count in response to detection of a first type of control transfer event and decrement the count in response to detection of a second type of control transfer event, and
a comparator to provide a notification of a ROP attack when the count exceeds a threshold during a window.
11. The processor of claim 10 , further comprising an instruction detector to detect an execution of a control transfer instruction, wherein the plurality of types of control transfer events comprise the control transfer instruction.
12. The processor of claim 10 , further comprising a return stack buffer to detect a return misprediction, wherein the plurality of types of control transfer events comprise the return misprediction.
13. The processor of claim 10 , wherein the plurality of types of control transfer events comprise a branch misprediction, and wherein the branch misprediction is detected by the branch prediction unit.
14. The processor of claim 10 , wherein the plurality of types of control transfer events comprise pairs of associated instructions.
15. The processor of claim 10 , the ROP detection unit further comprising bias logic to adjust the count to reduce at least one bias effect due to a natural imbalance.
16. The processor of claim 10 , the ROP detection unit further comprising control logic to adjust the threshold based on a desired level of protection against ROP attacks.
17. A system comprising:
a processor including Return Oriented Programming (ROP) detection logic, wherein the ROP detection logic is to determine whether a count exceeds a threshold during a window, wherein the ROP detection logic is to update the count in a first direction in response to one or more call instructions and update the count in a second direction in response to one or more return instructions; and
a random access memory coupled to the processor, wherein the random access memory includes an anti-malware application.
18. The system of claim 17 , wherein the ROP detection logic is further to, in response to a determination that the count exceeds the threshold during the window, provide a ROP attack notification to the anti-malware application.
19. The system of claim 18 , wherein the anti-malware application is to, in response to the ROP attack notification, initiate one or more actions to halt the ROP attack.
20. The system of claim 17 , wherein the window comprises a number of instructions.
21. A method, comprising:
detecting, by instruction control logic of a hardware processor, one or more call instructions and one or more return instructions;
adjusting, by Return Oriented Programming (ROP) detection logic of the hardware processor, a counter in a first direction in response to the one or more call instructions and updating the counter in a second direction in response to the one or more return instructions; and
upon determining that the counter exceeds a threshold during a window, notifying a protection application of a ROP attack.
22. The method of claim 21 , further comprising adjusting the counter in the second direction upon detecting a particular type of control transfer instruction.
23. The method of claim 21 , further comprising adjusting the counter in the second direction upon detecting a particular type of misprediction.
24. The method of claim 21 , further comprising, upon determining that the counter exceeds the threshold during the window, freezing contents of a branch instruction log of the hardware processor.