Control-flow integrity (CFI) is a general term for
computer security
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, t ...
techniques that prevent a wide variety of
malware attacks from redirecting the flow of execution (the
control flow
In computer science, control flow (or flow of control) is the order in which individual statements, instructions or function calls of an imperative program are executed or evaluated. The emphasis on explicit control flow distinguishes an ''im ...
) of a program.
Techniques
Associated techniques include code-pointer separation (CPS), code-pointer integrity (CPI),
stack canaries,
shadow stacks, and
vtable
In computer programming, a virtual method table (VMT), virtual function table, virtual call table, dispatch table, vtable, or vftable is a mechanism used in a programming language to support dynamic dispatch (or run-time method binding).
Wh ...
pointer verification.
Implementations
Related implementations are available in
Clang
Clang is a compiler front end for the C, C++, Objective-C, and Objective-C++ programming languages, as well as the OpenMP, OpenCL, RenderScript, CUDA, and HIP frameworks. It acts as a drop-in replacement for the GNU Compiler Collection ...
,
Microsoft's Control Flow Guard
and Return Flow Guard,
Google's Indirect Function-Call Checks
and Reuse Attack Protector (RAP).
Clang and Google Android
Google has shipped
Android with the
Linux kernel compiled by Clang with
link-time optimization
Interprocedural optimization (IPO) is a collection of compiler techniques used in computer programming to improve performance in programs containing many frequently used functions of small or medium length. IPO differs from other compiler optimiz ...
(LTO) and CFI since 2018.
Intel Control-flow Enforcement Technology
Intel Control-flow Enforcement Technology (CET) detects compromises to control flow integrity with a
shadow stack (SS) and indirect branch tracking (IBT).
The shadow stack stores a copy of the return address of each CALL in a specially-protected shadow stack. On a RET, the processor checks if the return address stored in the normal stack and shadow stack are equal. If the addresses are not equal, the processor generates an INT #21 (Control Flow Protection Fault).
Indirect branch tracking detects indirect JMP or CALL instructions with unauthorized targets. It is implemented by adding a new internal state machine in the processor. The behavior of indirect JMP and CALL instructions is changed so that they switch the state machine from IDLE to WAIT_FOR_ENDBRANCH. In the WAIT_FOR_ENDBRANCH state, the next instruction to be executed is required to be the new ENDBRANCH instruction (ENDBR32 in 32-bit mode or ENDBR64 in 64-bit mode), which changes the internal state machine from WAIT_FOR_ENDBRANCH back to IDLE. Thus every authorized target of an indirect JMP or CALL must begin with ENDBRANCH. If the processor is in a WAIT_FOR_ENDBRANCH state (meaning, the previous instruction was an indirect JMP or CALL), and the next instruction is not an ENDBRANCH instruction, the processor generates an INT #21 (Control Flow Protection Fault). On processors not supporting CET indirect branch tracking, ENDBRANCH instructions are interpreted as NOPs and have no effect.
Microsoft Control Flow Guard
Control Flow Guard (CFG) was first released for
Windows 8.1 Update 3 (KB3000850) in November 2014. Developers can add CFG to their programs by adding the
/guard:cf linker flag before program linking in Visual Studio 2015 or newer.
As of
Windows 10 Creators Update
Windows 10 Creators Update (also known as version 1703 and codenamed "Redstone 2") is the third major update to Windows 10 and the second in a series of updates under the Redstone codenames. It carries the build number 10.0.15063.
PC version histo ...
(Windows 10 version 1703), the Windows kernel is compiled with CFG.
The Windows kernel uses
Hyper-V
Microsoft Hyper-V, codenamed Viridian, and briefly known before its release as Windows Server Virtualization, is a native hypervisor; it can create virtual machines on x86-64 systems running Windows. Starting with Windows 8, Hyper-V superseded W ...
to prevent malicious kernel code from overwriting the CFG bitmap.
CFG operates by creating a per-process bitmap, where a set bit indicates that the address is a valid destination. Before performing each indirect function call, the application checks if the destination address is in the bitmap. If the destination address is not in the bitmap, the program terminates.
This makes it more difficult for an attacker to exploit a
use-after-free
Dangling pointers and wild pointers in computer programming are pointers that do not point to a valid object of the appropriate type. These are special cases of memory safety violations. More generally, dangling references and wild references are ...
by replacing an object's contents and then using an indirect function call to execute a payload.
Implementation details
For all protected indirect function calls, the
_guard_check_icall function is called, which performs the following steps:
# Convert the target address to an offset and bit number in the bitmap.
## The highest 3 bytes are the byte offset in the bitmap
## The bit offset is a 5-bit value. The first four bits are the 4th through 8th low-order bits of the address.
## The 5th bit of the bit offset is set to 0 if the destination address is aligned with 0x10 (last four bits are 0), and 1 if it is not.
# Examine the target's address value in the bitmap
## If the target address is in the bitmap, return without an error.
## If the target address is not in the bitmap, terminate the program.
Bypass techniques
There are several generic techniques for bypassing CFG:
* Set the destination to code located in a non-CFG module loaded in the same process.
* Find an indirect call that was not protected by CFG (either CALL or JMP).
* Use a function call with a different number of arguments than the call is designed for, causing a stack misalignment, and code execution after the function returns (patched in Windows 10).
* Use a function call with the same number of arguments, but one of pointers passed is treated as an object and writes to a pointer-based offset, allowing overwriting a return address.
* Overwrite the function call used by CFG to validate the address (patched in March 2015)
* Set the CFG bitmap to all 1's, allowing all indirect function calls
* Use a controlled-write primitive to overwrite an address on the stack (since the stack is not protected by CFG)
Microsoft eXtended Flow Guard
eXtended Flow Guard (XFG) has not been officially released yet, but is available in the Windows Insider preview and was publicly presented at Bluehat Shanghai in 2019.
XFG extends CFG by validating function call signatures to ensure that indirect function calls are only to the subset of functions with the same signature. Function call signature validation is implemented by adding instructions to store the target function's hash in register r10 immediately prior to the indirect call and storing the calculated function hash in the memory immediately preceding the target address's code. When the indirect call is made, the XFG validation function compares the value in r10 to the target function's stored hash.
See also
*
Buffer overflow protection Buffer overflow protection is any of various techniques used during software development to enhance the security of executable programs by detecting buffer overflows on stack-allocated variables, and preventing them from causing program misbehavior ...
*
Return-oriented programming
Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing.
In this technique, an attacker gains con ...
References
{{reflist, refs=
[{{Cite web , url=http://clang.llvm.org/docs/ControlFlowIntegrity.html , title=Control Flow Integrity — Clang 3.9 documentation , website=clang.llvm.org , access-date=2016-06-01]
[{{Cite web , url=https://nebelwelt.net/blog/20141007-CFICPSCPIdiffs.html , title=On differences between the CFI, CPS, and CPI properties , last1=Payer , first1=Mathias , author-link1=Mathias Payer, last2=Kuznetsov , first2=Volodymyr , website=nebelwelt.net , access-date=2016-06-01]
[{{Cite web , url=http://www.darkreading.com/vulnerabilities---threats/adobe-flash-bug-discovery-leads-to-new-attack-mitigation-method/d/d-id/1323092 , title=Adobe Flash Bug Discovery Leads To New Attack Mitigation Method , website=Dark Reading , date=10 November 2015 , access-date=2016-06-01]
[{{Cite web , url=http://www.prnewswire.com/news-releases/endgame-to-present-at-black-hat-usa-2016-300267060.html , title=Endgame to Present at Black Hat USA 2016 , last=Endgame , website=www.prnewswire.com , access-date=2016-06-01]
[{{Cite web , url=https://www.theregister.co.uk/2016/02/04/emets_win_10_revival_could_be_its_last_as_os_bakes_into_infosec/ , title=Microsoft's malware mitigator refreshed, but even Redmond says it's no longer needed , last=Pauli , first=Darren , website=]The Register
''The Register'' is a British technology news website co-founded in 1994 by Mike Magee, John Lettice and Ross Alderson. The online newspaper's masthead sublogo is "''Biting the hand that feeds IT''." Their primary focus is information te ...
, access-date=2016-06-01
[{{Cite web , url=http://www.networkworld.com/article/2985686/microsoft-subnet/derbycon-former-bluehat-prize-winner-will-bypass-control-flow-guard-in-windows-10.html , title=DerbyCon: Former BlueHat prize winner will bypass Control Flow Guard in Windows 10 , last=Smith , first=Ms. , website=Network World , date=23 September 2015 , access-date=2016-06-01]
[{{Cite book , last1=Tice , first1=Caroline , last2=Roeder , first2=Tom , last3=Collingbourne , first3=Peter , last4=Checkoway , first4=Stephen , last5=Erlingsson , first5=Úlfar , last6=Lozano , first6=Luis , last7=Pike , first7=Geoff , date=2014-01-01 , title=Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM , pages=941–955 , isbn=9781931971157 , url=https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/tice]
[{{Cite web , url=http://www.heise.de/security/meldung/PaX-Team-stellt-Schutz-vor-Code-Reuse-Exploits-vor-3197262.html , title=PaX Team stellt Schutz vor Code Reuse Exploits vor , last=Security , first=heise , website=Security , language=de-DE , access-date=2016-06-01]
[{{cite news , url=https://grsecurity.net/rap_faq.php , title=Frequently Asked Questions About RAP , access-date=2016-06-01]
<-- MS CFG-specific entries -->
[{{Cite web , url=https://threatpost.com/bypass-developed-for-microsoft-memory-protection-control-flow-guard/114768/ , title=Bypass Developed for Microsoft Memory Protection, Control Flow Guard , date=2015-09-22 , last=Mimoso , first=Michael , website=Threatpost {{! The first stop for security news , access-date=2016-06-01]
[{{Cite web , url=https://msdn.microsoft.com/en-us/library/windows/desktop/mt637065(v=vs.85).aspx , title=Control Flow Guard , website=MSDN , access-date=2017-01-19]
[{{Cite web, url=https://www.coresecurity.com/blog/exploiting-cve-2015-0311-part-ii-bypassing-control-flow-guard-on-windows-8-1-update-3 , title=Exploiting CVE-2015-0311, Part II: Bypassing Control Flow Guard on Windows 8.1 Update 3 , date=2015-03-25 , last=Falcón , first=Francisco , website=Core Security , access-date=2017-01-19]
[{{Cite web , url=http://www.powerofcommunity.net/poc2014/mj0011.pdf , title=Windows 10 Control Flow Guard Internals , website=Power of Community , access-date=2017-01-19]
[{{Cite web , url=https://documents.trendmicro.com/assets/wp/exploring-control-flow-guard-in-windows10.pdf , title=Control Flow Guard , website=Trend Micro , access-date=2017-01-19]
[{{Cite web , url=https://www.blackhat.com/docs/us-15/materials/us-15-Zhang-Bypass-Control-Flow-Guard-Comprehensively-wp.pdf , title=Bypass Control Flow Guard Comprehensively , website=BlackHat , access-date=2017-01-19]
[{{Cite web , url=https://labs.bromium.com/2015/09/28/an-interesting-detail-about-control-flow-guard/ , title=An interesting detail about Control Flow Guard , website=Bromium , access-date=2017-01-19]
[{{Cite web , url=http://www.slideshare.net/_s_n_t/object-oriented-exploitation-new-techniques-in-windows-mitigation-bypass , title=Object Oriented Exploitation: New techniques in Windows mitigation bypass , website=Slideshare , last=Thomas , first=Sam , date=18 August 2016 , access-date=2017-01-19]
[{{Cite web , url=http://xlab.tencent.com/en/2016/11/02/return-flow-guard/ , title=Return Flow Guard , website=Tencent , date=2 November 2016 , access-date=2017-01-19]
[{{Cite web , url=https://blogs.technet.microsoft.com/mmpc/2017/06/16/analysis-of-the-shadow-brokers-release-and-mitigation-with-windows-10-virtualization-based-security/ , title=Analysis of the Shadow Brokers release and mitigation with Windows 10 virtualization-based security , website=Microsoft Technet , date=16 June 2017 , access-date=2017-06-20]
[{{Cite web , url=http://alex-ionescu.com/publications/euskalhack/euskalhack2017-cfg.pdf , title=Universally Bypassing CFG Through Mutability Abuse , website=Alex Ionescu's Blog , access-date=2017-07-07]
[{{Cite web , url=https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf , title=Control-flow Enforcement Technology Specification , website=Intel Developer Zone , access-date=2021-01-05{{dead link, date=July 2021]
[{{Cite web , url=https://windows-internals.com/cet-on-windows/ , title=R.I.P ROP: CET Internals in Windows 20H1 , website=Winsider Seminars & Solutions Inc. , access-date=2021-01-05]
[{{Cite web , url=https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE37dMC , title=Advancing Windows Security , access-date=2021-05-19]
[{{Cite web , url=https://www.offensive-security.com/offsec/extended-flow-guard/ , title=EXTENDED FLOW GUARD UNDER THE MICROSCOPE , access-date=2021-05-19]
[{{Cite web , url=https://connormcgarr.github.io/examining-xfg/ , title=Exploit Development: Between a Rock and a (Xtended Flow) Guard Place: Examining XFG , date=23 August 2020 , access-date=2021-05-19]
Computer security