vfGuard: Strict Protection for Virtual Function Calls in COTS C++ Binaries

Abstract—Control-Flow Integrity (CFI) is an important security property that needs to be enforced to prevent controlflow hijacking attacks. Recent attacks have demonstrated that existing CFI protections for COTS binaries are too permissive, and vulnerable to sophisticated code reusing attacks. Accounting for control flow restrictions imposed at higher levels of semantics is key to increasing CFI precision. In this paper, we aim to provide more stringent protection for virtual function calls in COTS C++ binaries by recovering C++ level semantics. To achieve this goal, we recover C++ semantics, including VTables and virtual callsites. With the extracted C++ semantics, we construct a sound CFI policy and further improve the policy precision by devising two filters, namely “Nested Call Filter” and “Calling Convention Filter”. We implement a prototype system called vfGuard, and evaluate its accuracy, precision, effectiveness, coverage and performance overhead against a test set...

• Type: Journal
• Year: 2015
• Where: NDSS
• Authors: Aravind Prakash, Xunchao Hu, Heng Yin
• Keywords: Computer Networks, NDSS 2015