Repository logo

Infoscience

  • English
  • French
Log In
Logo EPFL, École polytechnique fédérale de Lausanne

Infoscience

  • English
  • French
Log In
  1. Home
  2. Academic and Research Output
  3. Conferences, Workshops, Symposiums, and Seminars
  4. CFIXX: Object Type Integrity for C++
 
conference paper

CFIXX: Object Type Integrity for C++

Burow, Nathan
•
McKee, Derrick
•
Carr, Scott A.
Show more
2018
25th Annual Network and Distributed System Security Symposium, NDSS 2018
25 Network and Distributed System Security Symposium

C++ relies on object type information for dynamic dispatch and casting. The association of type information to an object is implemented via the virtual table pointer, which is stored in the object itself. As C++ has neither memory nor type safety, adversaries may therefore overwrite an object’s type. If the corrupted type is used for dynamic dispatch, the attacker has hijacked the application’s control flow. This vulnerability is widespread and commonly exploited. Firefox, Chrome, and other major C++ applications are network facing, commonly attacked, and make significant use of dynamic dispatch. Control-Flow Integrity (CFI) is the state of the art policy for efficient mitigation of control-flow hijacking attacks. CFI mechanisms determine statically (i.e., at compile time) the set of functions that are valid at a given call site, based on C++ semantics. We propose an orthogonal policy, Object Type Integrity (OTI), that dynamically tracks object types. Consequently, instead of allowing a set of targets for each dynamic dispatch on an object, only the single, correct target for the object’s type is allowed. To show the efficacy of OTI, we present CFIXX, which enforces OTI. CFIXX enforces OTI by dynamically tracking the type of each object and enforcing its integrity against arbitrary writes. CFIXX has minimal overhead on CPU bound applications such as SPEC CPU2006 — 4.98%. On key applications like Chromium, CFIXX has negligible overhead on JavaScript benchmarks: 2.03% on Octane, 1.99% on Kraken, and 2.80% on JetStream. We show that CFIXX can be deployed in conjunction with CFI, providing a significant security improvement.

  • Details
  • Metrics
Type
conference paper
DOI
10.14722/ndss.2018.23279
Scopus ID

2-s2.0-85180413083

Author(s)
Burow, Nathan

Purdue University

McKee, Derrick

Purdue University

Carr, Scott A.

Purdue University

Payer, Mathias  

École Polytechnique Fédérale de Lausanne

Date Issued

2018

Publisher

The Internet Society

Published in
25th Annual Network and Distributed System Security Symposium, NDSS 2018
ISBN of the book

1891562495

9781891562495

Editorial or Peer reviewed

REVIEWED

Written at

EPFL

EPFL units
HEXHIVE  
Event nameEvent acronymEvent placeEvent date
25 Network and Distributed System Security Symposium

San Diego, United States

2018-02-18 - 2018-02-21

FunderFunding(s)Grant NumberGrant URL

Marion Marschalek

National Science Foundation

CNS-1513783

ONR

N00014-17-1-2513

Show more
Available on Infoscience
April 4, 2025
Use this identifier to reference this record
https://infoscience.epfl.ch/handle/20.500.14299/248592
Logo EPFL, École polytechnique fédérale de Lausanne
  • Contact
  • infoscience@epfl.ch

  • Follow us on Facebook
  • Follow us on Instagram
  • Follow us on LinkedIn
  • Follow us on X
  • Follow us on Youtube
AccessibilityLegal noticePrivacy policyCookie settingsEnd User AgreementGet helpFeedback

Infoscience is a service managed and provided by the Library and IT Services of EPFL. © EPFL, tous droits réservés