Countering buffer overrun security vulnerabilities in a CPU

• US 20020144141A1
• Filed: 03/31/2001
• Published: 10/03/2002
• Est. Priority Date: 03/31/2001
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Strahm, Frederick W., Saint-Hilaire, Ylian, Richardson, John W., Edwards, James W.
• Application Number:
  US09/823,491
• Publication Number:
  US 20020144141A1
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information

Abstract

A method and apparatus are described for preventing security vulnerabilities resulting from buffer overruns. According to one embodiment of the present invention, CALL is modified to place a return address on the stack, and then a random amount of space is added to the stack. This random value is placed in a known place on the stack, or kept in a non-accessible CPU register. The rest of the stack is built normally. When RET is called it finds the number of bytes added to the stack and finds the return address on the stack and returns as normal. This method allows a simple hardware solution that will not be visible to the software, yet provide a powerful deterrent to hackers looking to exploit buffer overrun vulnerabilities in software. Without any software modifications we would be able to deter a significant number of buffer overrun attacks. By affecting components lower on the environment it is possible to influence a larger set of software. For example, it is possible to affect all of the software running on the system without having to change any of the software.

Claims

1. A method of preventing buffer overrun security vulnerabilities comprising:

executing a modified call routine for placing a random amount of empty space onto a stack;

executing a called function; and

executing a modified return routine for removing said random amount of empty space from the stack.

2. The method of claim 1, wherein said modified call routine comprises:

placing a return address for the called function on the stack;

calculating a random number;

saving said random number in a secure location;

placing a plurality of blank bytes equal to the random number onto the stack;

building a stack frame by placing values from the called function onto the stack; and

setting an end of stack pointer to an end of the stack frame.

3. The method of claim 2, wherein said location is a processor register that is not generally accessible.

4. The method of claim 1, wherein said modified return routine comprises:

recalling a random number saved during an execution of said modified call routine;

removing a number of bytes equal to said random number from the stack;

retrieving a return address for the called function from the stack; and

setting an end of stack pointer to an end of a previous stack frame.

5. The method of claim 1, wherein said modified call routine comprises:

placing a return address for the called function on the stack;

calculating a hash value of stack invariants;

saving said hash value in a secure location; and

building a stack frame by placing values from the called function onto the stack.

6. The method of claim 5, wherein said secure location is a processor register that is not generally accessible.

7. The method of claim 1, wherein said modified return routine comprises:

calculating a second hash value of stack invariants;

determining whether said second hash value matches a first hash value calculated during an execution of said modified call routine;

executing a stack corruption exception if said second hash value does not match said first hash value; and

setting an end of stack pointer to an end of a previous stack frame if said second hash value matches said first hash value.

8. A method of preventing buffer overrun security vulnerabilities comprising:

searching an executable program for all function calls at the time the executable is installed;

adding a random amount of blank space to all stacks generated by said function calls;

adjusting all references to said stacks to compensate for said blank space.

9. The method of claim 8, wherein said method is performed when said executable is installed.

10. The method of claim 9, further comprising saving said executable.

11. The method of claim 8, wherein said method is performed when said executable is loaded.

13. The apparatus of claim 12, wherein said modified call routine comprises:

placing a return address for the called function on the stack;

calculating a random number;

saving said random number in a secure location;

placing a plurality of blank bytes equal to the random number onto the stack;

building a stack frame by placing values from the called function onto the stack; and

setting an end of stack pointer to an end of the stack frame.

14. The apparatus of claim 13, wherein said location is a processor register that is not generally accessible.

15. The apparatus of claim 12, wherein said modified return routine comprises:

recalling a random number saved during an execution of said modified call routine;

removing a number of bytes equal to said random number from the stack;

retrieving a return address for the called function from the stack; and

setting an end of stack pointer to an end of a previous stack frame.

16. The apparatus of claim 12, wherein said modified call routine comprises:

placing a return address for the called function on the stack;

calculating a hash value of stack invariants;

saving said hash value in a secure location; and

building a stack frame by placing values from the called function onto the stack.

17. The apparatus of claim 16, wherein said secure location is a processor register that is not generally accessible.

18. The apparatus of claim 12, wherein said modified return routine comprises:

calculating a second hash value of stack invariants;

determining whether said second hash value matches a first hash value calculated during an execution of said modified call routine;

executing a stack corruption exception if said second hash value does not match said first hash value; and

setting an end of stack pointer to an end of a previous stack frame if said second hash value matches said first hash value.

20. The apparatus of claim 19, wherein said method is performed when said executable is installed.

21. The apparatus of claim 20, further comprising saving said executable.

22. The apparatus of claim 19, wherein said method is performed when said executable is loaded.

24. The machine-readable medium of claim 23, wherein said modified call routine comprises:

placing a return address for the called function on the stack;

calculating a random number;

saving said random number in a secure location;

placing a plurality of blank bytes equal to the random number onto the stack;

building a stack frame by placing values from the called function onto the stack; and

setting an end of stack pointer to an end of the stack frame.

25. The machine-readable medium of claim 24, wherein said location is a processor register that is not generally accessible.

26. The machine-readable medium of claim 23, wherein said modified return routine comprises:

recalling a random number saved during an execution of said modified call routine;

removing a number of bytes equal to said random number from the stack;

retrieving a return address for the called function from the stack; and

setting an end of stack pointer to an end of a previous stack frame.

27. The machine-readable medium of claim 23, wherein said modified call routine comprises:

placing a return address for the called function on the stack;

calculating a hash value of stack invariants;

saving said hash value in a secure location; and

building a stack frame by placing values from the called function onto the stack.

28. The machine-readable medium of claim 27, wherein said secure location is a processor register that is not generally accessible.

29. The machine-readable medium of claim 23, wherein said modified return routine comprises:

calculating a second hash value of stack invariants;

determining whether said second hash value matches a first hash value calculated during an execution of said modified call routine;

executing a stack corruption exception if said second hash value does not match said first hash value; and

setting an end of stack pointer to an end of a previous stack frame if said second hash value matches said first hash value.

12. An apparatus comprising:

a storage device having stored therein one or more routines for preventing buffer overrun security vulnerabilities; and

a processor coupled to the storage device for executing the one or more routines that, when executing the routines, prevents buffer overrun errors by;

executing a modified call routine for placing a random amount of empty space onto a stack;

executing a called function; and

executing a modified return routine for removing said random amount of empty space from the stack.

19. An apparatus comprising:

a storage device having stored therein one or more routines for preventing buffer overrun security vulnerabilities; and

a processor coupled to the storage device for executing the one or more routines that, when executing the routines, prevents buffer overrun errors by;

searching an executable program for all function calls at the time the executable is installed;

adding a random amount of blank space to all stacks generated by said function calls;

adjusting all references to said stacks to compensate for said blank space.

23. A machine-readable medium having stored thereon data representing sequences of instructions, said sequences of instructions which, when executed by a processor, cause said processor to prevents buffer overrun errors by:

executing a modified call routine for placing a random amount of empty space onto a stack;

executing a called function; and

executing a modified return routine for removing said random amount of empty space from the stack.

30. A machine-readable medium having stored thereon data representing sequences of instructions, said sequences of instructions which, when executed by a processor, cause said processor to prevents buffer overrun errors by:

searching an executable program for all function calls at the time the executable is installed;

adding a random amount of blank space to all stacks generated by said function calls;

adjusting all references to said stacks to compensate for said blank space.

31. The machine-readable medium of claim 30, wherein said method is performed when said executable is installed.

32. The machine-readable medium of claim 31, further comprising saving said executable.

33. The machine-readable medium of claim 30, wherein said method is performed when said executable is loaded.