Efficient Protection of Path-Sensitive Control Security
summary
Path-sensitive CFI uses runtime, path-sensitive points-to analysis combined with hardware tracing to reduce target sets and stop realistic control-flow hijacks. The implementation, PITTYPAT, pairs an Intel PT kernel monitor with a user-space incremental points-to analyzer, validates control transfers at syscalls, and flags violations. Evaluation shows it detects all 264 ROP/CFI benchmarks, yields 95% single-target indirect transfers on average, and runs about 12% overhead vs. baseline. Limits: no non-control-data protection, array-indexes remain imprecise, and it consumes TNT/TIP PT packets.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:34What is Control Flow?
- 0:51What is Control Hijacking?
- 1:28Control Flow Attacks Stil Exist...
- 2:43Control Flow Integrity (CFI)
- 3:21Motivating Example
- 4:41Limitation of Traditional CFI
- 5:23Per-Input CFI: Most Precise Known CFI
- 6:03Limitation of Per-Input CFI
- 7:19PITTYPAT: Path-Sensitive CFI
- 8:07Assumptions
- 8:39Challenges
- 9:51Intel Processor Trace
- 10:43Incremental Points-to Analysis
- 11:13Things Differentiate Our Analysis
- 12:34System Overview
- 14:15Challenging Language Features
- 14:31Signal Handling
- 15:34Exception Handling
- 16:05Optimizations on Analysis
- 17:13Evaluation
- 17:50Forward Edge Points-to Set Size
- 19:53Performance Overhead
- 21:00Limitations
- 21:48Conclusion
related talks
01h 46mA little Introduction to Control Flow Integrity
27mFiner-grained kernel control flow integrity and challenges
01h 34mA Little Introduction to Control Flow Integrity in C++
01h 05mHow to Survive the Hardware Assisted Control-Flow Integrity Enforcement
45mControl Flow Integrity in the Linux Kernel
44mLinux Kernel Control-Flow Integrity Sup...
28mCOFI break
35mControl Flow Integrity on RISC-V Linux