Mathias Payer, Code-Pointer Integrity

Programs are full of bugs, leading to vulnerabilities. We'll discusspower and limitations of code-pointer integrity (CPI), a strong butpractical security policy that enforces memory safety for all codepointers, protecting against any form of control-flow hijack attack(e. g., ROP or JOP).Systems code is often written in low-level languages like C/C++, whichoffer many benefits but also delegate memory management toprogrammers. This invites memory safety bugs that attackers canexploit to divert control flow and compromise the system. Deployeddefence mechanisms (e. g., ASLR, DEP) are incomplete, and strongerdefence mechanisms (e. g., CFI) often have high overhead and limitedguarantees (and are therefore not generally deployed).In this talk we discuss code-pointer integrity (CPI), a strongsecurity policy that guarantees the integrity of all code pointers ina program (e.g., function pointers, saved return addresses) andthereby prevents all control-flow hijack attacks, includingreturn-oriented programming and jump-oriented programming. We alsointroduce code-pointer separation (CPS), a relaxation of CPI withbetter performance properties. Both CPI and CPS offer substantiallybetter security-to-overhead ratios than the state of the art, they arepractical (we protect a complete FreeBSD system and over 100 packageslike apache and postgresql), effective (prevent all attacks in theRIPE benchmark), and efficient, resulting in very low to negligibleperformance overhead. About the speaker: Mathias Payer is a security researcher and an assistant professor incomputer science at Purdue university. His interests are related tosystem security, binary exploitation, user-space software-based faultisolation, binary translation/recompilation, and (application)virtualization. His research focuses on protecting applications evenin the presence of vulnerabilities, with a focus on memory corruption.