Sigreturn-oriented programming (SROP) is a
computer security exploit
An exploit is a method or piece of code that takes advantage of Vulnerability (computer security), vulnerabilities in software, Application software, applications, Computer network, networks, operating systems, or Computer hardware, hardware, typic ...
technique that allows an attacker to execute code in presence of security measures such as
non-executable memory and code signing.
It was presented for the first time at the 35th
IEEE Symposium on Security and Privacy in 2014 where it won the ''best student paper award''. This technique employs the same basic assumptions behind the
return-oriented programming
Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable-space protection and code signing.
In this technique, an attacker gains con ...
(ROP) technique: an attacker controlling the
call stack
In computer science, a call stack is a Stack (abstract data type), stack data structure that stores information about the active subroutines and block (programming), inline blocks of a computer program. This type of stack is also known as an exe ...
, for example through a
stack buffer overflow
In software, a stack buffer overflow or stack buffer overrun occurs when a program writes to a memory address on the program's call stack outside of the intended data structure, which is usually a fixed-length buffer.
Stack buffer overflow bugs ...
, is able to influence the
control flow
In computer science, control flow (or flow of control) is the order in which individual statements, instructions or function calls of an imperative program are executed or evaluated. The emphasis on explicit control flow distinguishes an '' ...
of the program through simple instruction sequences called ''
gadget
A gadget is a machine, mechanical device or any ingenious article. Gadgets are sometimes referred to as ''wikt:gizmo, gizmos''.
History
The etymology of the word is disputed. The word first appears as reference to an 18th-century tool in Glass ...
s''. The attack works by
pushing a forged ''sigcontext'' structure on the call stack, overwriting the original return address with the location of a gadget that allows the attacker to call the ''sigreturn''
system call
In computing, a system call (syscall) is the programmatic way in which a computer program requests a service from the operating system on which it is executed. This may include hardware-related services (for example, accessing a hard disk drive ...
.
Often just a single gadget is needed to successfully put this attack into effect. This gadget may reside at a fixed location, making this attack simple and effective, with a setup generally simpler and more portable than the one needed by the plain return-oriented programming technique.
Sigreturn-oriented programming can be considered a
weird machine since it allows code execution outside the original specification of the program.
Background
Sigreturn-oriented programming (SROP) is a technique similar to return-oriented programming (ROP), since it employs
code reuse
Code reuse is the practice of using existing source code to develop software instead of writing new code. ''Software reuse'' is a broader term that implies using any existing software asset to develop software instead of developing it again. An as ...
to execute code outside the scope of the original control flow. In this sense, the adversary needs to be able to carry out a
stack smashing attack, usually through a stack buffer overflow, to overwrite the return address contained inside the call stack.
Stack hopping exploits
If mechanisms such as
data execution prevention are employed, it won't be possible for the attacker to just place a
shellcode
In hacking, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised ma ...
on the stack and cause the machine to execute it by overwriting the return address. With such protections in place, the machine won't execute any code present in memory areas marked as writable and non-executable. Therefore, the attacker will need to reuse code already present in memory.
Most programs do not contain functions that will allow the attacker to directly carry out the desired action (e.g., obtain access to a
shell
Shell may refer to:
Architecture and design
* Shell (structure), a thin structure
** Concrete shell, a thin shell of concrete, usually with no interior columns or exterior buttresses
Science Biology
* Seashell, a hard outer layer of a marine ani ...
), but the necessary instructions are often scattered around memory.
Return-oriented programming requires these sequences of instructions, called gadgets, to end with a
RET
instruction. In this way, the attacker can write a sequence of addresses for these gadgets to the stack, and as soon as a
RET
instruction in one gadget is executed, the control flow will proceed to the next gadget in the list.
Signal handler mechanism

This attack is made possible by how
signals are handled in most
POSIX
The Portable Operating System Interface (POSIX; ) is a family of standards specified by the IEEE Computer Society for maintaining compatibility between operating systems. POSIX defines application programming interfaces (APIs), along with comm ...
-like systems. Whenever a signal is delivered, the kernel needs to
context switch
In computing, a context switch is the process of storing the state of a process or thread, so that it can be restored and resume execution at a later point, and then restoring a different, previously saved, state. This allows multiple processes ...
to the installed signal handler. To do so, the kernel saves the current execution context in a frame on the stack.
The structure pushed onto the stack is an architecture-specific variant of the ''sigcontext'' structure, which holds various data comprising the contents of the registers at the moment of the context switch. When the execution of the signal handler is completed, the
sigreturn()
system call is called.
Calling the ''sigreturn'' syscall means being able to easily set the contents of registers using a single gadget that can be easily found on most systems.
Differences from ROP
There are several factors that characterize an SROP exploit and distinguish it from a classical return-oriented programming exploit.
First, ROP is dependent on available gadgets, which can be very different in distinct
binaries
A binary file is a computer file that is not a text file. The term "binary file" is often used as a term meaning "non-text file". Many binary file formats contain parts that can be interpreted as text; for example, some computer document files ...
, thus making chains of gadget non-portable.
Address space layout randomization
Address space layout randomization (ASLR) is a computer security technique involved in preventing exploitation of memory corruption vulnerabilities. In order to prevent an attacker from reliably redirecting code execution to, for example, a pa ...
(ASLR) makes it hard to use gadgets without an
information leakage to get their exact positions in memory.
Although
Turing-complete
In computability theory, a system of data-manipulation rules (such as a model of computation, a computer's instruction set, a programming language, or a cellular automaton) is said to be Turing-complete or computationally universal if it can be ...
ROP compilers exist, it is usually non-trivial to create a ROP chain.
SROP exploits are usually portable across different binaries with minimal or no effort and allow easily setting the contents of the registers, which could be non-trivial or unfeasible for ROP exploits if the needed gadgets are not present.
Moreover, SROP requires a minimal number of gadgets and allows constructing effective shellcodes by chaining system calls. These gadgets are always present in memory, and in some cases are always at fixed locations:
[
]
Attacks
Linux
An example of the kind of gadget needed for SROP exploits can always be found in the virtual dynamic shared object (VDSO) memory area on x86-Linux
Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...
systems:
__kernel_sigreturn proc near:
pop eax
mov eax, 77h
int 80h ; LINUX - sys_sigreturn
nop
lea esi, si+0__kernel_sigreturn endp
On some Linux kernel
The Linux kernel is a Free and open-source software, free and open source Unix-like kernel (operating system), kernel that is used in many computer systems worldwide. The kernel was created by Linus Torvalds in 1991 and was soon adopted as the k ...
versions, ASLR can be disabled by setting the limit for the stack size to unlimited, effectively bypassing ASLR and allowing easy access to the gadget present in a VDSO.
For Linux kernels prior to version 3.3, it is also possible to find a suitable gadget inside the vsyscall page, which is a mechanism to accelerate the access to certain system calls often used by legacy programs and resides always at a fixed location.
Turing-completeness
It is possible to use gadgets to write into the contents of the stack frames, thereby constructing a self-modifying program. Using this technique, it is possible to devise a simple virtual machine
In computing, a virtual machine (VM) is the virtualization or emulator, emulation of a computer system. Virtual machines are based on computer architectures and provide the functionality of a physical computer. Their implementations may involve ...
, which can be used as the compilation target for a Turing-complete
In computability theory, a system of data-manipulation rules (such as a model of computation, a computer's instruction set, a programming language, or a cellular automaton) is said to be Turing-complete or computationally universal if it can be ...
language. An example of such an approach can be found in Bosman's paper, which demonstrates the construction of an interpreter for a language similar to the Brainfuck programming language. The language provides a program counter PC
, a memory pointer P
, and a temporary register used for 8-bit addition A
. This means that complex backdoors or obfuscated attacks can also be devised.
Defenses and mitigations
A number of techniques exists to mitigate SROP attacks, relying on address space layout randomization
Address space layout randomization (ASLR) is a computer security technique involved in preventing exploitation of memory corruption vulnerabilities. In order to prevent an attacker from reliably redirecting code execution to, for example, a pa ...
, canaries and cookie
A cookie is a sweet biscuit with high sugar and fat content. Cookie dough is softer than that used for other types of biscuit, and they are cooked longer at lower temperatures. The dough typically contains flour, sugar, egg, and some type of ...
s, or shadow stacks.
Address space layout randomization
Address space layout randomization makes it harder to use suitable gadgets by making their locations unpredictable.
Signal cookies
A mitigation for SROP called ''signal cookies'' has been proposed. It consists of a way of verifying that the sigcontext structure has not been tampered with by the means of a random cookie XORed with the address of the stack location where it is to be stored. In this way, the ''sigreturn'' syscall just needs to verify the cookie's existence at the expected location, effectively mitigating SROP with a minimal impact on performances.
Vsyscall emulation
In Linux kernel versions greater than 3.3, the vsyscall interface is emulated, and any attempt to directly execute gadgets in the page will result in an exception.
RAP
Grsecurity is a set of patches for the Linux kernel
The Linux kernel is a Free and open-source software, free and open source Unix-like kernel (operating system), kernel that is used in many computer systems worldwide. The kernel was created by Linus Torvalds in 1991 and was soon adopted as the k ...
to harden and improve system security. It includes the so-called return-address protection (RAP) to help protect against code reuse attacks.
CET
Starting in 2016, Intel
Intel Corporation is an American multinational corporation and technology company headquartered in Santa Clara, California, and Delaware General Corporation Law, incorporated in Delaware. Intel designs, manufactures, and sells computer compo ...
is developing a Control-flow Enforcement Technology (''CET'') to help mitigate and prevent stack-hopping exploits. CET works by implementing a shadow stack in RAM which will only contain return addresses, protected by the CPU's memory management unit
A memory management unit (MMU), sometimes called paged memory management unit (PMMU), is a computer hardware unit that examines all references to computer memory, memory, and translates the memory addresses being referenced, known as virtual mem ...
.
See also
* Linux kernel interfaces
The Linux kernel provides multiple interfaces to User space and kernel space, user-space and kernel-mode code. The interfaces can be classified as either application programming interface (API) or application binary interface (ABI), and they ca ...
* Vulnerability (computing)
Vulnerabilities are flaws or weaknesses in a system's design, implementation, or management that can be exploited by a malicious actor to compromise its security.
Despite a system administrator's best efforts to achieve complete correctness, vi ...
* Exploit (computer security)
An exploit is a method or piece of code that takes advantage of Vulnerability (computer security), vulnerabilities in software, Application software, applications, Computer network, networks, operating systems, or Computer hardware, hardware, typic ...
* Buffer overflow
* Address space layout randomization
Address space layout randomization (ASLR) is a computer security technique involved in preventing exploitation of memory corruption vulnerabilities. In order to prevent an attacker from reliably redirecting code execution to, for example, a pa ...
* Executable space protection
In computer security, executable-space protection marks memory regions as non-executable, such that an attempt to execute machine code in these regions will cause an exception. It relies on hardware features such as the NX bit (no-execute bit), ...
* NX bit
The NX bit (no-execute bit) is a processor feature that separates areas of a virtual address space (the memory layout a program uses) into sections for storing data or program instructions. An operating system supporting the NX bit can mark certai ...
References
{{Reflist
External links
OHM 2013: Review of “Returning signals for fun and profit
SigReturn Oriented Programming on x86-64 linux
Computer security exploits