Control Flow Integrity Based on Controlled Channel

By ensuring the Control Flow Integrity (CFI) of a program, one can successfully verify that each performed action is indeed part of a correct execution flow thus preventing unwanted behaviour caused by malicious inputs. Validating the Control Flow Graph (CFG) is usually done by instrumenting the code and enforcing a set of conditions which imply overhead and compiler support. In this paper, we investigate an alternative approach, based on controlled-channel: by invalidating certain pages and monitoring the Page Faults, we generate a CFG of faulting instructions which we use to detect unusual execution flows (e.g. buffer overflows, ROP) and discuss methods to estimate and mitigate the induced overhead. Using the page invalidation selection algorithms that we propose, we obtain an approximate slowdown factor of 3.43. This can be further reduced by doing a manual analysis of the involved binaries and sacrificing accuracy for speed.