Abstract—Many mechanisms have been proposed and deployed
to prevent exploits against software vulnerabilities. Among
them, W⊕X is one of the most effective and efficient. W⊕X
prevents memory pages from being simultaneously writable
and executable, rendering the decades old shellcode injection
technique infeasible.
In this paper, we demonstrate that the traditional shellcode
injection attack can be revived through a code cache injection
technique. Specifically, dynamic code generation, a technique
widely used in just-in-time (JIT) compilation and dynamic binary
translation (DBT), generates and modifies code on the fly in order
to promote performance or security. The dynamically generated
code fragments are stored in a code cache, which is writable
and executable either at the same time or alternately, resulting
in an opportunity for exploitation. This threat is especially
realistic when the generated code is multi-threaded, because
switching between writable and executable leaves a time window
for exploitation. To illustrate this threat, we have crafted a proofof-concept
exploit against modern browsers that support Web
Workers.
To mitigate this code cache injection threat, we propose a
new dynamic code generation architecture. This new architecture
relocates the dynamic code generator to a separate process,
in which the code cache is writable. In the original process
where the generated code executes, the code cache remains readonly.
The code cache is synchronized across the writing process
and the execution process through shared memory. Interaction
between the code generator and the generated code is handled
transparently through remote procedure calls (RPC). We have
ported the Google V8 JavaScript engine and the Strata DBT
to this new architecture. Our implementation experience showed
that the engineering effort for porting to this new architecture
is minimal. Evaluation of our prototype implementation showed
that this new architecture can defeat the code cache injection
attack with small performance overhead.
more here.........http://wenke.gtisc.gatech.edu/papers/sdcg.pdf
![]()