Repository logo

Infoscience

  • English
  • French
Log In
Logo EPFL, École polytechnique fédérale de Lausanne

Infoscience

  • English
  • French
Log In
  1. Home
  2. Academic and Research Output
  3. Conferences, Workshops, Symposiums, and Seminars
  4. The Taming of the Stack: Isolating Stack Data from Memory Errors
 
conference paper

The Taming of the Stack: Isolating Stack Data from Memory Errors

Huang, Kaiming
•
Huang, Yongzhe
•
Payer, Mathias  
Show more
2022
29th Annual Network and Distributed System Security Symposium, NDSS 2022
29 Network and Distributed System Security Symposium

Despite vast research on defenses to protect stack objects from the exploitation of memory errors, much stack data remains at risk. Historically, stack defenses focus on the protection of code pointers, such as return addresses, but emerging techniques to exploit memory errors motivate the need for practical solutions to protect stack data objects as well. However, recent approaches provide an incomplete view of security by not accounting for memory errors comprehensively and by limiting the set of objects that can be protected unnecessarily. In this paper, we present the DATAGUARD system that identifies which stack objects are safe statically from spatial, type, and temporal memory errors to protect those objects efficiently. DATAGUARD improves security through a more comprehensive and accurate safety analysis that proves a larger number of stack objects are safe from memory errors, while ensuring that no unsafe stack objects are mistakenly classified as safe. DATAGUARD's analysis of server programs and the SPEC CPU2006 benchmark suite shows that DATAGUARD improves security by: (1) ensuring that no memory safety violations are possible for any stack objects classified as safe, removing 6.3% of the stack objects previously classified safe by the Safe Stack method, and (2) blocking exploit of all 118 stack vulnerabilities in the CGC Binaries. DATAGUARD extends the scope of stack protection by validating as safe over 70% of the stack objects classified as unsafe by the Safe Stack method, leading to an average of 91.45% of all stack objects that can only be referenced safely. By identifying more functions with only safe stack objects, DATAGUARD reduces the overhead of using Clang's Safe Stack defense for protection of the SPEC CPU2006 benchmarks from 11.3% to 4.3%. Thus, DATAGUARD shows that a comprehensive and accurate analysis can both increase the scope of stack data protection and reduce overheads.

  • Details
  • Metrics
Type
conference paper
DOI
10.14722/NDSS.2022.23060
Scopus ID

2-s2.0-85141907212

Author(s)
Huang, Kaiming

Pennsylvania State University

Huang, Yongzhe

Pennsylvania State University

Payer, Mathias  

École Polytechnique Fédérale de Lausanne

Qian, Zhiyun

University of California, Riverside

Sampson, Jack

Pennsylvania State University

Tan, Gang

Pennsylvania State University

Jaeger, Trent

Pennsylvania State University

Date Issued

2022

Publisher

The Internet Society

Published in
29th Annual Network and Distributed System Security Symposium, NDSS 2022
ISBN of the book

1891562746

9781891562747

Editorial or Peer reviewed

REVIEWED

Written at

EPFL

EPFL units
HEXHIVE  
Event nameEvent acronymEvent placeEvent date
29 Network and Distributed System Security Symposium

Hybrid, San Diego, United States

2022-04-24 - 2022-04-28

FunderFunding(s)Grant NumberGrant URL

U.S. government

European Research Council

European Union's Horizon 2020 research and innovation program

Show more
Available on Infoscience
April 4, 2025
Use this identifier to reference this record
https://infoscience.epfl.ch/handle/20.500.14299/248595
Logo EPFL, École polytechnique fédérale de Lausanne
  • Contact
  • infoscience@epfl.ch

  • Follow us on Facebook
  • Follow us on Instagram
  • Follow us on LinkedIn
  • Follow us on X
  • Follow us on Youtube
AccessibilityLegal noticePrivacy policyCookie settingsEnd User AgreementGet helpFeedback

Infoscience is a service managed and provided by the Library and IT Services of EPFL. © EPFL, tous droits réservés