Stack pivot exploit detection and mitigation
Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting exploits. In aspects, various “checkpoints” may be identified in software code. At each checkpoint, the current stack pointer, stack base, and stack limit for each mode of execution may be obtained. The current stack pointer for each mode of execution may be evaluated to determine whether the stack pointer falls within a stack range between the stack base and the stack limit of the respective mode of execution. When the stack pointer is determined to be outside of the expected stack range, a stack pivot exploit is detected and one or more remedial actions may be automatically performed.
1. A system for stack pivot exploit detection and mitigation, comprising:
a processor; and
memory storing instructions that, when executed by the processor, causes the system to perform a set of operations for stack pivot detection and mitigation, the set of operations comprising:
defining, for a process executing in an execution mode, thread information for the process, the thread information comprising a current memory pointer, a memory base, and a memory limit, the memory base and the memory limit defining a memory range for the process;
based on the current memory pointer for the process executing in the execution mode, generating a corresponding memory base pointer for the memory base, and a corresponding memory limit pointer for the memory limit;
comparing the current memory pointer for the thread information to the memory base pointer and the memory limit pointer to determine whether the current memory pointer is within the memory range;
when the current memory pointer is determined to be within the memory range, permitting the process to execute;
when the current memory pointer is determined to not be within the memory range, determining an occurrence of a stack pivot exploit and, in response, performing a remedial action; and
executing a series of checkpoints over time, each checkpoint determining the occurrence of the stack pivot, wherein the execution mode comprises a kernel execution mode, a 32-bit execution mode, and a 64-bit execution mode, each, the execution mode having a corresponding series of checkpoints for determining the occurrence of a stack pivot within each execution mode.
2. The system of claim 1 , wherein each execution mode has a thread information block storing thread information in a datasource.
3. The system of claim 1 , wherein the remedial action comprises at least one of: generating notifications output to a user interface, terminating the process, modifying a set of user permissions associated with the process, and quarantining a file associated with the process.
4. The system of claim 1 , wherein comparing the current memory pointer for the thread information to the memory base pointer and the memory limit pointer to determine whether the current memory pointer is within the memory range comprises:
comparing a memory address for the current memory pointer to the memory range, the memory range comprising a range of memory addresses from the memory address for the memory base pointer and the memory address for the memory limit pointer to determine whether the memory address for the current memory pointer is within the range of memory addresses.
5. The system of claim 1 , wherein each checkpoint of the series of checkpoints is specific to a file or file type.
6. A method for stack pivot exploit detection and mitigation, comprising:
defining, for a process executing in an execution mode, thread information for the process, the thread information comprising a current memory pointer, a memory base, and a memory limit, the memory base and the memory limit defining a memory range for the process;
based on the current memory pointer for the process executing in the execution mode, generating a corresponding memory base pointer for the memory base, and a corresponding memory limit pointer for the memory limit;
comparing the current memory pointer for the thread information to the memory base pointer and the memory limit pointer to determine whether the current memory pointer is within the memory range;
when the current memory pointer is determined to be within the memory range, permitting the process to execute;
when the current memory pointer is determined to not be within the memory range, determining an occurrence of a stack pivot exploit and, in response, performing a remedial action; and
executing a series of checkpoints over time, each checkpoint determining the occurrence of the stack pivot, wherein the execution mode comprises a kernel execution mode, a 32-bit execution mode, and a 64-bit execution mode, each execution mode having a corresponding series of checkpoints for determining the occurrence of a stack pivot within each execution mode.
7. The method of claim 6 , wherein each execution mode has a thread information block storing thread information in a datasource.
8. The method of claim 6 , wherein the remedial action comprises at least one of: generating notifications output to a user interface, terminating the process, modifying a set of user permissions associated with the process, and quarantining a file associated with the process.
9. The method of claim 6 , wherein comparing the current memory pointer for the thread information to the memory base pointer and the memory limit pointer to determine whether the current memory pointer is within the memory range comprises:
comparing a memory address for the current memory pointer to the memory range, the memory range comprising a range of memory addresses from the memory address for the memory base pointer and the memory address for the memory limit pointer to determine whether the memory address for the current memory pointer is within the range of memory addresses.
10. The method of claim 6 , wherein each checkpoint of the series of checkpoints is specific to a file or file type.
11. A computer storage device storing instructions that, when executed, are capable of performing a method for stack pivot exploit detection and mitigation, the method comprising:
defining, for a process executing in an execution mode, thread information for the process, the thread information comprising a current memory pointer, a memory base, and a memory limit, the memory base and the memory limit defining a memory range for the process;
based on the current memory pointer for the process executing in the execution mode, generating a corresponding memory base pointer for the memory base, and a corresponding memory limit pointer for the memory limit;
comparing the current memory pointer for the thread information to the memory base pointer and the memory limit pointer to determine whether the current memory pointer is within the memory range;
when the current memory pointer is determined to be within the memory range, permitting the process to execute;
when the current memory pointer is determined to not be within the memory range, determining an occurrence of a stack pivot exploit and, in response, performing a remedial action; and
executing a series of checkpoints over time, each checkpoint determining the occurrence of the stack pivot, wherein the execution mode comprises a kernel execution mode, a 32-bit execution mode, and a 64-bit execution mode, each execution mode having a corresponding series of checkpoints for determining the occurrence of a stack pivot within each execution mode.
12. The computer storage device of claim 11 , wherein each execution mode has a thread information block storing thread information in a datasource.
13. The computer storage device claim 11 , wherein the remedial action comprises at least one of: generating notifications output to a user interface, terminating the process, modifying a set of user permissions associated with the process, and quarantining a file associated with the process.
14. The computer storage device claim 11 , wherein each checkpoint of the series of checkpoints is specific to a file or file type.