Satellite: Effective and Efficient Stack Memory Protection Scheme for Unsafe Programming Languages

1. Bigelow, D., Hobson, T., Rudd, R., Streilein, W., Okhravi, H.: Timely rerandomization for mitigating memory disclosures. In: Proceedings of the 22nd ACM Conference on Computer and Communications Security (CCS), pp. 268–279 (2015)

   Google Scholar 

2. Burow, N., Zhang, X., Payer, M.: SoK: shining light on shadow stacks. In: Proceedings of the 40th IEEE Symposium on Security and Privacy (Oakland), San Francisco, CA, pp. 985–999 (2019)

   Google Scholar 

3. Wu, C., et al.: Dancing with wolves: an intra-process isolation technique with privileged hardware. IEEE Trans. Dependable Secure Comput. 20(3), 1959–1978 (2022)

   Article  Google Scholar 

4. Cho, H., et al.: Exploiting uses of uninitialized stack variables in linux kernels to leak kernel pointers. In: Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT), p. 3 (2020)

   Google Scholar 

5. Corbet, J.: x86 NX support (2004). https://lwn.net/%20Articles/87814/

6. Evans, I., et al.: Missing the point (ER): on the effectiveness of code pointer integrity. In: Proceedings of the 36th IEEE Symposium on Security and Privacy (Oakland), San Jose, CA, pp. 781–796 (2015)

   Google Scholar 

7. Hofemeier, G., Chesebrough, R.: Introduction to intel AES-NI and intel secure key instructions (2012). https://www.intel.com/content/dam/develop/external/us/en/documents/introduction-to-intel-secure-key-instructions.pdf

8. Intel: Intel (R) 64 and IA-32 Architectures Software Developer’s Manual (2016). https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html

9. Koning, K., Chen, X., Bos, H., Giuffrida, C., Athanasopoulos, E.: No need to hide: protecting safe regions on commodity hardware. In: Proceedings of the 12th European Conference on Computer Systems (EUROSys), Belgrade, Serbia, pp. 437–452 (2017)

   Google Scholar 

10. Kuznetsov, V., Szekeres, L., Payer, M., Candea, G., Sekar, R., Song, D.: \(\{\)Code-pointer\(\}\) integrity. In: Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI), Broomfield, CO, pp. 147–163 (2014)

    Google Scholar 

11. LLVM: SafeStack (2015). https://clang.llvm.org/docs/SafeStack.html

12. Lu, K., Song, C., Lee, B., Chung, S.P., Kim, T., Lee, W.: ASLR-guard: stopping address space leakage for code reuse attacks. In: Proceedings of the 22nd ACM Conference on Computer and Communications Security (CCS), pp. 280–291 (2015)

    Google Scholar 

13. Salehi, M., Degani, L., Roveri, M., Hughes, D., Crispo, B.: Discovery and identification of memory corruption vulnerabilities on bare-metal embedded devices. IEEE Trans. Dependable Secure Comput. 20(2), 1124–1138 (2023)

    Article  Google Scholar 

14. Matz, M.: System v application binary interface (2013). aMD64 Architecture Processor Supplement, Draft v0

    Google Scholar 

15. Microsoft: A detailed description of the data execution prevention (DEP) feature in Windows XP Service Pack 2, Windows XP Tablet PC Edition 2005, and Windows Server 2003 (2006). http://support.microsoft.com/kb/875352/EN-US/

16. Microsoft: Control flow guard (2016). http://msdn.microsoft.com/en-us/library/Dn919635.aspx

17. Microsoft, Corporation: CVE-2018-0973 (2018). https://www.cve.org/CVERecord?id=CVE-2018-0973

18. Mitre, Corporation: CVE Details (2023). https://www.cvedetails.com/

19. Oikonomopoulos, A., Athanasopoulos, E., Bos, H., Giuffrida, C.: Poking holes in information hiding. In: Proceedings of the 25th USENIX Security Symposium (Security), Austin, TX, pp. 121–138 (2016)

    Google Scholar 

20. One, Aleph: Smashing the stack for fun and profit. Phrack Magazine (1996)

    Google Scholar 

21. PaX, Team: PaX address space layout randomization(ASLR). http://pax.grsecurity.net/docs/aslr.txt

22. Baradaran, S., Heidari, M., Kamali, A., Mouzarani, M.: A unit-based symbolic execution method for detecting memory corruption vulnerabilities in executable codes. Int. J. Inf. Secur. 22(1), 1277–1290 (2023)

    Article  Google Scholar 

23. Checkoway, S., Davi, L.., Dmitrienko, A., Sadeghi, A.R., Shacham, H., Winandy, M.: Return-oriented programming without returns. In: Proceedings of the 17th ACM Conference on Computer and Communications Security (CCS), pp. 559–572 (2010)

    Google Scholar 

24. Szekeres, L., Payer, M., Wei, T., Song, D.: SoK: eternal war in memory. In: Proceedings of the 35th IEEE Symposium on Security and Privacy (Oakland), San Francisco, CA, pp. 48–62 (2013)

    Google Scholar 

25. Team, 82: Exploited: Netgear Nighthawk RAX30. Pwn2own (2023)

    Google Scholar 

26. Team82: CVE-2023-27357 (2023). https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27357

27. Vahldiek-Oberwagner, A., Elnikety, E., Duarte, N.O., Sammler, M., Druschel, P., Garg, D.: \(\{\)ERIM\(\}\): secure, efficient in-process isolation with protection keys (\(\{\)MPK\(\}\)). In: Proceedings of the 28th USENIX Security Symposium (Security), Santa Clara, CA, pp. 1221–1238 (2019)

    Google Scholar 

28. Wagle, P., Cowan, C.: Stackguard: simple stack smash protection for GCC. In: Proceedings of the the GCC Developers Summit, Ottawa, Canada, pp. 1–268 (2003)

    Google Scholar 

29. Wang, Z., et al.: ReRanz: a light-weight virtual machine to mitigate memory disclosure attacks. In: Proceedings of the 13th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE), pp. 143–156. Xi’an, China (2017)

    Google Scholar 

30. Wang, Z., et al.: SEIMI: efficient and secure SMAP-enabled intra-process memory isolation. In: Proceedings of the 41st IEEE Symposium on Security and Privacy (Oakland), San Jose, CA, pp. 592–607 (2020)

    Google Scholar 

31. Wang, Z., et al.: SafeHidden: an efficient and secure information hiding technique using re-randomization. In: Proceedings of the 28th USENIX Security Symposium (Security), Santa Clara, CA, pp. 1239–1256 (2019)

    Google Scholar 

32. Zieris, P., Horsch, J.: A leak-resilient dual stack scheme for backward-edge control-flow integrity. In: Proceedings of the 13th ACM Symposium on Information, Computer and Communications Security (ASIACCS), Incheon, Korea, pp. 369–380 (2018)

    Google Scholar 

Download references