When good instructions go bad: generalizing return-oriented programming to RISC

This paper reconsiders the threat posed by Shacham's "return-oriented programming" -- a technique by which WX-style hardware protections are evaded via carefully crafted stack frames that divert control flow into the middle of existing variable-length x86 instructions -- creating short new instructions streams that then return. We believe this attack is both more general and a greater threat than the author appreciated. In fact, the vulnerability is not limited to the x86 architecture or any particular operating system, is readily exploitable, and bypasses an entire category of malware protections. In this paper we demonstrate general return-oriented programming on the SPARC, a fixed instruction length RISC architecture with structured control flow. We construct a Turing-complete library of code gadgets using snippets of the Solaris libc, a general purpose programming language, and a compiler for constructing return-oriented exploits. Finally, we argue that the threat p...

• Type: Conference
• Year: 2008
• Where: CCS
• Authors: Erik Buchanan, Ryan Roemer, Hovav Shacham, Stefan Savage
• Keywords: CCS 2008, Control Flow, Return-oriented Programming, Security Privacy, Variable-length X86 Instructions