Thwarting ROP Attacks and Unveiling User Level Stack Tampering Through Kernel Shadow Stack

One of the most reliable and effective solutions against Return-Oriented Programming (ROP) attacks is the incorporation of Backward Edge Control-Flow Integrity. The most prominent implementation of this concept involves the integration of a dedicated shadow stack, which is a distinct memory structure used for saving and checking functions’ return addresses, and consequently, enforcing the control flow within a program. In this article we propose an alternative perspective to this established notion via the introduction of KSS, a Kernel Shadow Stack for user programs. Our solution not only upholds program flow but also enables determining which code block has been the origin of stack tampering. Furthermore, by placing itself at a higher privilege level, its information can no way be altered by the (attacked) user-level code. Overall, it does not only offer the support for more secure program operations, rather it also allows the analysis of program flows-an aspect that can be very relevant in software deploy phases. Beyond a kernellevel subsystem, which we developed for Linux, KSS includes an instrumentation engine and a custom loader designed to enable its usage with preexisting programs, with no need for any access to the program’s source code. Via experimental results we show how the impact of costs (in terms of CPU-cycles) inherent to the implementation of KSS can be definitely reduced in scenarios involving networking-based applications where threads classically exhibit an I/O-bound execution profile.