ABSTRACT
With the advent of JIT compilers, code-injection attacks have seen a revival in the form of JIT spraying. JIT spraying enables an attacker to inject gadgets into executable memory, effectively sidestepping W⊕X and ASLR.
In response to JIT spraying, constant blinding has emerged as a conceptually straightforward and performance friendly defense. Unfortunately, increasingly sophisticated attacks have pinpointed the shortcomings of existing constant blinding implementations.
In this paper we present our constant blinding implementation in the GraalVM compiler, enabling constant blinding across a wide range of languages. Our implementation takes insights from the last decade of research on the security of constant blinding into account. We discuss important design decisions and trade-offs as well as the practical implementation issues encountered when implementing constant blinding for GraalVM. We evaluate the performance impact of our implementation with different configurations and demonstrate its effectiveness by fuzzing for unblinded constants.
References
- 2014. RockJIT: Securing Just-In-Time Compilation Using Modular Control-Flow Integrity. In ACM SIGSAC Conference on Computer and Communications Security.Google Scholar
- Martín Abadi, Mihai Budiu, Úlfar Erlingsson, and Jay Ligatti. 2005. A Theory of Secure Control Flow. In International Conference on Formal Methods and Software Engineering.Google ScholarDigital Library
- Martín Abadi, Mihai Budiu, Úlfar Erlingsson, and Jay Ligatti. 2009. Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security 13, 1 (Oct. 2009), 1–40.Google ScholarDigital Library
- Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis, and Sotiris Ioannidis. 2015. The Devil is in the Constants: Bypassing Defenses in Browser JIT Engines. In Network and Distributed System Security Symposium.Google ScholarCross Ref
- John Aycock. 2003. A brief history of just-in-time. Comput. Surveys 35, 2 (jun 2003), 97–113.Google ScholarDigital Library
- Dionysus Blazakis. 2010. Interpreter Exploitation.. In USENIX Workshop on Offensive Technologies.Google Scholar
- Preston Briggs, Keith D Cooper, and L. Taylor Simpson. 1997. Value Numbering. Software—Practice & Experience 27, 6 (1997), 701–724.Google ScholarDigital Library
- Ping Chen, Rui Wu, and Bing Mao. 2013. JITSafe: a framework against Just-in-time spraying attacks. IET Information Security 7, 4 (dec 2013), 283–292.Google ScholarCross Ref
- Stephen Crane, Christopher Liebchen, Andrei Homescu, Lucas Davi, Per Larsen, Ahmad-Reza Sadeghi, Stefan Brunthaler, and Michael Franz. 2015. Readactor: Practical Code Randomization Resilient to Memory Disclosure. In IEEE Symposium on Security and Privacy.Google ScholarDigital Library
- Ron Cytron, Jeanne Ferrante, Barry K. Rosen, Mark N. Wegman, and F. Kenneth Zadeck. 1991. Efficiently computing static single assignment form and the control dependence graph. ACM Transactions on Programming Languages and Systems 13, 4 (oct 1991), 451–490.Google ScholarDigital Library
- Gilles Duboscq, Thomas Würthinger, Lukas Stadler, Christian Wimmer, Doug Simon, and Hanspeter Mössenböck. 2013. An intermediate representation for speculative optimizations in a dynamic compiler. In ACM workshop on Virtual machines and intermediate languages. New York, New York, USA.Google ScholarDigital Library
- E C Fieller. 1954. Some Problems in Interval Estimation. Journal of the Royal Statistical Society. Series B (Methodological) 16, 2 (1954), 175–185.Google ScholarCross Ref
- Tommaso Frassetto, David Gens, Christopher Liebchen, and Ahmad-Reza Sadeghi. 2017. JITGuard: Hardening Just-in-time Compilers with SGX. In ACM SIGSAC Conference on Computer and Communications Security.Google ScholarDigital Library
- Robert Gawlik and Thorsten Holz. 2018. SoK: Make JIT-Spray Great Again. In USENIX Workshop on Offensive Technologies.Google Scholar
- Andrei Homescu, Stefan Brunthaler, Per Larsen, and Michael Franz. 2013. Librando: transparent code randomization for just-in-time compilers. In ACM SIGSAC Conference on Computer & Communications security.Google ScholarDigital Library
- Martin Jauernig, Matthias Neugschwandtner, Christian Platzer, and Paolo Milani Comparetti. 2014. Lobotomy: An Architecture for JIT Spraying Mitigation. In International Conference on Availability, Reliability and Security.Google Scholar
- Vladimir Kozlov. [n.d.]. JDK-7072317. https://bugs.openjdk.java.net/browse/JDK-7072317Google Scholar
- Per Larsen, Andrei Homescu, Stefan Brunthaler, and Michael Franz. 2014. SoK: Automated Software Diversity. In IEEE Symposium on Security and Privacy.Google Scholar
- Wilson Lian, Hovav Shacham, and Stefan Savage. 2015. Too LeJIT to Quit: Extending JIT Spraying to ARM. In Network and Distributed System Security Symposium.Google ScholarCross Ref
- Wilson Lian, Hovav Shacham, and Stefan Savage. 2017. A Call to ARMs: Understanding the Costs and Benefits of JIT Spraying Mitigations. In Network and Distributed System Security Symposium.Google ScholarCross Ref
- Giorgi Maisuradze, Michael Backes, and Christian Rossow. 2016. What Cannot be Read, Cannot be Leveraged? Revisiting Assumptions of JIT-ROP Defenses. In USENIX Security Symposium.Google Scholar
- Giorgi Maisuradze, Michael Backes, and Christian Rossow. 2017. Dachshund: Digging for and Securing (Non-)Blinded Constants in JIT Code. In Network and Distributed System Security Symposium.Google Scholar
- Microsoft. [n. d.]. Super Duper Secure Mode. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/Google Scholar
- Aleksandar Prokopec, Andrea Rosà, David Leopoldseder, Gilles Duboscq, Petr Tůma, Martin Studener, Lubomír Bulej, Yudi Zheng, Alex Villazón, Doug Simon, Thomas Würthinger, and Walter Binder. 2019. Renaissance: Benchmarking Suite for Parallel Applications on the JVM. In ACM SIGPLAN Conference on Programming Language Design and Implementation.Google Scholar
- Elena Reshetova, Filippo Bonazzi, and N Asokan. 2016. Randomization can’t stop BPF JIT spray. In Black Hat USA.Google Scholar
- Chris Rohlf and Yan Ivnitskiy. 2011. Attacking clientside JIT compilers. In Black Hat USA.Google Scholar
- B. K. Rosen, M. N. Wegman, and F. K. Zadeck. 1988. Global value numbers and redundant computations. In ACM SIGPLAN-SIGACT symposium on Principles of programming languages – POPL ’88.Google Scholar
- Takahiro Shinagawa, Yuki Suzuki, Tomoyuki Nakayama, and Masanori Misono. 2
