Detection of return oriented programming attacks
View Patent ↗In one embodiment, a processor includes at least one execution unit and Return Oriented Programming (ROP) detection logic. The ROP detection logic may determine a ROP metric based on a plurality of control transfer events. The ROP detection logic may also determine whether the ROP metric exceeds a threshold. The ROP detection logic may also, in response to a determination that the ROP metric exceeds the threshold, provide a ROP attack notification.
1. A processor comprising:
a Return Oriented Programming (ROP) detection unit to:
adjust a count in a first direction in response to detection of one or more control transfer events of a first type and adjust the count in a second direction in response to detection of one or more control transfer events of a second type; and
in response to a determination that the count exceeds a threshold, provide an indication of a possible ROP attack.
2. The processor of claim 1 , wherein the ROP detection unit comprises an accumulator to store the count.
3. The processor of claim 1 , wherein the ROP detection unit is to increment the count in response to an instance of a subroutine return instruction, wherein the subroutine return instruction is a control transfer event of the first type.
4. The processor of claim 3 , wherein the ROP detection unit is to decrement the count in response to an instance of a subroutine call instruction, wherein the subroutine call instruction is a control transfer event of the second type.
5. The processor of claim 3 , wherein the ROP detection unit is further to increment the count in response to a return misprediction.
6. The processor of claim 3 , wherein the ROP detection unit is further to increment the count in response to an instance of a control transfer instruction associated with a stack pop instruction.
7. The processor of claim 3 , wherein the ROP detection unit is further to increment the count in response to an instance of a control transfer instruction associated with an increase in a stack pointer.
8. The processor of claim 1 , wherein the indication of the possible ROP attack is to trigger a protection application to take one or more actions to address the ROP attack.
9. The processor of claim 1 , wherein the ROP detection unit is further to freeze a branch instruction log when the count exceeds the threshold.
10. A processor comprising:
an accumulator to generate a count in response to detection of a plurality of types of control transfer events, wherein the accumulator is to update the count in a first direction in response to a first control transfer event type and update the count in a second direction in response to a second control transfer event type; and
a comparator to provide a notification of a Return Oriented Programming (ROP) attack when the count exceeds a threshold during a window.
11. The processor of claim 10 , further comprising an instruction detector to detect an execution of a control transfer instruction, wherein the plurality of types of control transfer events includes the execution of the control transfer instruction.
12. The processor of claim 10 , further comprising a return stack buffer to detect a return misprediction, wherein the plurality of types of control transfer events includes the return misprediction.
13. The processor of claim 10 , further comprising a branch prediction unit to detect a branch misprediction, wherein the plurality of types of control transfer events includes the branch misprediction.
14. The processor of claim 10 , wherein the plurality of types of control transfer events includes a pair of associated instructions.
15. The processor of claim 10 , further comprising bias logic to adjust the count to reduce at least one bias effect due to a natural imbalance.
16. The processor of claim 10 , further comprising control logic to adjust the threshold based on a desired level of protection against ROP attacks.
17. A non-transitory machine-readable medium having stored thereon instructions, which if performed by a machine cause the machine to perform a method comprising:
detecting, by instruction control logic of a hardware processor, one or more call instructions and one or more return instructions;
updating, by Return Oriented Programming (ROP) detection logic of the hardware processor, a count in a first direction in response to the one or more call instructions and updating the count in a second direction in response to the one or more return instructions; and
in response to a determination that the count exceeds a threshold during a window, notifying a protection application of a ROP attack.
18. The machine-readable medium of claim 17 , wherein the method further comprises updating the count in the second direction in response to a stack pivot.
19. The machine-readable medium of claim 17 , wherein the method further comprises updating the count in the second direction in response to a particular type of misprediction.
20. The machine-readable medium of claim 17 , wherein the method further comprises, in response to a determination that the count exceeds the threshold during the window, freezing contents of a branch instruction log of the hardware processor.
21. The processor of claim 10 , wherein the processor further comprises:
an instruction detector to detect at least some of the plurality of types of control transfer events and to send a detection signal to the accumulator, wherein the detection signal is to indicate a type of control transfer event.