Control flow integrity enforcement at scale
Various technologies described herein pertain to enforcing control flow integrity by adding instrumentation when source code is compiled or binary code is rewritten. An indirect call to a control transfer target (e.g., in the source code, in the binary code, etc.) can be identified. Moreover, the instrumentation can be inserted prior to the indirect call. The instrumentation can use a bit from a bitmap maintained by a runtime to verify whether the control transfer target is valid. When an executable image that includes the inserted instrumentation runs, execution can be terminated and/or other appropriate actions can be taken when the control transfer target is determined to be invalid; alternatively, execution can continue when the control transfer target is determined to be valid.
1. A method of running an executable image, the method executed by a processor and comprising:
loading the executable image;
initializing a portion of a bitmap managed by a runtime, wherein the portion of the bitmap is initialized based on metadata embedded in the executable image;
determining validity of a control transfer target of an indirect call in the executable image based on whether a corresponding bit in the bitmap is set, wherein the validity of the control transfer target is determined by detecting corruption of a return address from the control transfer target on a stack by verifying a function signature of the control transfer target being called by the indirect call responsive to the corresponding bit in the bitmap being set, wherein the bitmap comprises two bits per aligned address, and wherein a state of one of the two bits indicates that the corresponding aligned address has the function signature to be checked;
terminating execution of the executable image when the control transfer target is determined to be invalid; and
continuing the execution of the executable image when the control transfer target is determined to be valid.
2. The method of claim 1 , wherein the bitmap is shared for determining validity of a disparate control transfer target of a disparate executable image.
3. The method of claim 1 , further comprising:
creating a pagefile-backed section to be used for the bitmap during operating system initialization;
mapping a reserved, read-only view of the pagefile-backed section into address space of a process during creation of the process;
determining whether the executable image is loaded at a chosen base address;
setting a bit associated with the executable image in the bitmap based on the metadata embedded in the executable image when the executable image is loaded at the chosen base address; and
creating a private page in the bitmap when the executable image is loaded at a disparate base address that differs from the chosen base address, wherein the private page in the bitmap corresponds to the disparate base address.
4. The method of claim 1 , wherein the validity of the control transfer target is determined by instrumentation included in the executable image.
5. The method of claim 4 , wherein the instrumentation included in the executable image is a call to an external check routine, and wherein the external check routine determines whether the bit from the bitmap is set for the control transfer target.
6. The method of claim 4 , wherein the instrumentation included in the executable image is an inline bitmap check that directly determines whether the bit from the bitmap is set for the control transfer target.
7. The method of claim 1 , further comprising detecting the corruption of the return address from the control transfer target on the stack using a check inserted in the executable image.
8. The method of claim 7 , further comprising detecting the corruption of the return address on the stack using a security cookie for a function that calls the control transfer target, wherein a value of the security cookie is computed based on an intended return address of the function.
9. The method of claim 1 , wherein the function signature is verified using a versioned function signature that is represented by a data structure that includes one or more possible function signatures for a function being called by the indirect call in an array, and wherein the possible function signatures correspond to values computed using different versions of a function signature computation algorithm.
10. The method of claim 1 , wherein a bit in the bitmap identifies a range of addresses for indirect control transfer, and wherein a code pattern of a function provides that only a first byte in the function is possibly called.
11. A system that executes an executable image, comprising:
at least one processor; and
memory that comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:
loading the executable image;
initializing a portion of a bitmap managed by a runtime, wherein the portion of the bitmap is initialized based on metadata embedded in the executable image;
determining validity of a control transfer target of an indirect call in the executable image based on whether a corresponding bit in the bitmap is set, wherein the validity of the control transfer target is determined by detecting corruption of a return address from the control transfer target on a stack by verifying a function signature of the control transfer target being called by the indirect call responsive to the corresponding bit in the bitmap being set, wherein the bitmap comprises two bits per aligned address, and wherein a state of one of the two bits indicates that the corresponding aligned address has the function signature to be checked;
terminating execution of the executable image when the control transfer target is determined to be invalid; and
continuing the execution of the executable image when the control transfer target is determined to be valid.
12. The system of claim 11 , wherein the bitmap is shared for determining validity of a disparate control transfer target of a disparate executable image.
13. The system of claim 11 , wherein the validity of the control transfer target is determined by instrumentation included in the executable image.
14. The system of claim 11 , the memory further comprising computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:
detecting the corruption of the return address from the control transfer target on the stack using a check inserted in the executable image.
15. The system of claim 11 , wherein a bit in the bitmap identifies a range of addresses for indirect control transfer, and wherein a code pattern of a function provides that only a first byte in the function is possibly called.
16. The system of claim 11 , wherein loading the executable image comprises:
checking whether a base address has been chosen for the executable image; and
setting a corresponding bit in the bitmap pertaining to the base address when the base address has been chosen.
17. The system of claim 11 , wherein the function signature is verified using a versioned function signature that is represented by a data structure that includes one or more possible function signatures for a function being called by the indirect call in an array, and wherein the possible function signatures correspond to values computed using different versions of a function signature computation algorithm.
18. A computer-readable storage medium including computer-executable instructions that, when executed by a processor, cause the processor to perform acts including:
loading an executable image;
initializing a portion of a bitmap managed by a runtime, wherein the portion of the bitmap is initialized based on metadata embedded in the executable image;
determining validity of a control transfer target of an indirect call in the executable image based on whether a corresponding bit in the bitmap is set, wherein the validity of the control transfer target is determined by detecting corruption of a return address from the control transfer target on a stack by verifying a function signature of the control transfer target being called by the indirect call responsive to the corresponding bit in the bitmap being set, wherein the bitmap comprises two bits per aligned address, and wherein a state of one of the two bits indicates that the corresponding aligned address has the function signature to be checked;
terminating execution of the executable image when the control transfer target is determined to be invalid; and
continuing the execution of the executable image when the control transfer target is determined to be valid.
19. The computer-readable storage medium of claim 18 , wherein the bitmap is shared for determining validity of a disparate control transfer target of a disparate executable image.
20. The computer-readable storage medium of claim 18 , wherein the validity of the control transfer target is determined by instrumentation included in the executable image.