Mitigating Over-Permissible Transfer for Control Flow Integrity

Control flow integrity (CFI) is a promising defense mechanism for controlling hijacking attacks. In most situations, CFI prevents the control flow transfer from hijacking by the adversary. However, the over-permissible transfer problem remains a major issue in most CFI systems. By taking advantage of this problem, an adversary can still hijack control flows to the code not designed by the original programmer but intended for execution by the adversary. To eliminate over-permissible transfer, we propose transfer target analysis for the CFI system. With value set analysis and concolic execution, the transfer target analysis is able to construct the precise control flow graph. Given the fine-grained policy, over-permissible transfer can be prohibited. To save memory, the Bloom filter-based policy database is established to store a large number of policies in a compact data structure with low false positive rate. The evaluation uses benign programs from the SPEC CPU2006 benchmarks and the malign programs from the RIPE benchmark. The result shows that all the benign programs can execute normally but all the malign programs are blocked.