Stack pivot exploit detection and mitigation
Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting exploits. In aspects, various “checkpoints” may be identified in software code. At each checkpoint, the current stack pointer, stack base, and stack limit for each mode of execution may be obtained. The current stack pointer for each mode of execution may be evaluated to determine whether the stack pointer falls within a stack range between the stack base and the stack limit of the respective mode of execution. When the stack pointer is determined to be outside of the expected stack range, a stack pivot exploit is detected and one or more remedial actions may be automatically performed.
1. A system for stack pivot exploit detection and mitigation, comprising:
a processor; and
memory storing instructions that, when executed by the processor, causes the system to perform a set of operations for stack pivot detection and mitigation, the set of operations comprising:
defining, for a process executing in an execution mode, thread information for the process, the thread information comprising a current stack pointer, a stack base, and a stack limit, the stack base and the stack limit defining a stack memory range for the process;
based on the current stack pointer for the process executing in the execution mode, generating a corresponding stack base pointer for the stack base, and a corresponding stack limit pointer for the stack limit;
comparing the current stack pointer for the thread information to the stack base pointer and the stack limit pointer to determine whether the current stack pointer is within the stack memory range;
when the current stack pointer is determined to be within the stack memory range, permitting the process to execute;
when the current stack pointer is determined to not be within the stack memory range, determining an occurrence of a stack pivot exploit and, in response, performing a remedial action; and
executing a series of checkpoints over time, each checkpoint determining the occurrence of the stack pivot, wherein the execution mode comprises a kernel execution mode, a 32-bit execution mode, and a 64-bit execution mode, each execution mode having a corresponding series of checkpoints for determining the occurrence of a stack pivot within each execution mode.
2. The system of claim 1 , wherein each execution mode has a thread information block storing thread information in a datasource.
3. The system of claim 1 , wherein the remedial action comprises at least one of: generating notifications output to a user interface, terminating the process, modifying a set of user permissions associated with the process, and quarantining a file associated with the process.
4. The system of claim 1 , wherein comparing the current stack pointer for the thread information to the stack base pointer and the stack limit pointer to determine whether the current stack pointer is within the stack memory range comprises:
comparing a memory address for the current stack pointer to the stack memory range, the stack memory range comprising a range of memory addresses from the memory address for the stack base pointer and the memory address for the stack limit pointer to determine whether the memory address for the current stack pointer is within the range of memory addresses.
5. A method for stack pivot exploit detection and mitigation, comprising:
defining, for a process executing in an execution mode, thread information for the process, the thread information comprising a current stack pointer, a stack base, and a stack limit, the stack base and the stack limit defining a stack memory range for the process;
based on the current stack pointer for the process executing in the execution mode, generating a corresponding stack base pointer for the stack base, and a corresponding stack limit pointer for the stack limit;
comparing the current stack pointer for the thread information to the stack base pointer and the stack limit pointer to determine whether the current stack pointer is within the stack memory range;
when the current stack pointer is determined to be within the stack memory range, permitting the process to execute;
when the current stack pointer is determined to not be within the stack memory range, determining an occurrence of a stack pivot exploit and, in response, performing a remedial action and
executing a series of checkpoints over time, each checkpoint determining the occurrence of the stack pivot, wherein the execution mode comprises a kernel execution mode, a 32-bit execution mode, and a 64-bit execution mode, each execution mode having a corresponding series of checkpoints for determining the occurrence of a stack pivot within each execution mode.
6. The method of claim 5 , wherein each execution mode has a thread information block storing thread information in a datasource.
7. The method of claim 5 , wherein the remedial action comprises at least one of: generating notifications output to a user interface, terminating the process, modifying a set of user permissions associated with the process, and quarantining a file associated with the process.
8. The method of claim 5 , wherein comparing the current stack pointer for the thread information to the stack base pointer and the stack limit pointer to determine whether the current stack pointer is within the stack memory range comprises:
comparing a memory address for the current stack pointer to the stack memory range, the stack memory range comprising a range of memory addresses from the memory address for the stack base pointer and the memory address for the stack limit pointer to determine whether the memory address for the current stack pointer is within the range of memory addresses.
9. A computer storage device storing instructions that, when executed, are capable of performing a method for stack pivot exploit detection and mitigation, the method comprising:
defining, for a process executing in an execution mode, thread information for the process, the thread information comprising a current stack pointer, a stack base, and a stack limit, the stack base and the stack limit defining a stack memory range for the process;
based on the current stack pointer for the process executing in the execution mode, generating a corresponding stack base pointer for the stack base, and a corresponding stack limit pointer for the stack limit;
comparing the current stack pointer for the thread information to the stack base pointer and the stack limit pointer to determine whether the current stack pointer is within the stack memory range;
when the current stack pointer is determined to be within the stack memory range, permitting the process to execute;
when the current stack pointer is determined to not be within the stack memory range, determining an occurrence of a stack pivot exploit and, in response, performing a remedial action; and
executing a series of checkpoints over time, each checkpoint determining the occurrence of the stack pivot, wherein the execution mode comprises a kernel execution mode, a 32-bit execution mode, and a 64-bit execution mode, each execution mode having a corresponding series of checkpoints for determining the occurrence of a stack pivot within each execution mode.
10. The computer storage device of claim 9 , wherein each execution mode has a thread information block storing thread information in a datasource.
11. The computer storage device claim 9 , wherein the remedial action comprises at least one of: generating notifications output to a user interface, terminating the process, modifying a set of user permissions associated with the process, and quarantining a file associated with the process.