Return-Oriented Programming on RISC-V - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

Return-Oriented Programming on RISC-V

Konstantinos Markantonakis
  • Fonction : Auteur
  • PersonId : 994012
Raja Naeem Akram
  • Fonction : Auteur
  • PersonId : 1036545
David Robin
  • Fonction : Auteur
Keith Mayes
  • Fonction : Auteur
  • PersonId : 994013
David Naccache
  • Fonction : Auteur
  • PersonId : 928358

Résumé

This paper provides the first analysis on the feasibility of Return-Oriented Programming (ROP) on RISC-V, a new instruction set architecture targeting embedded systems. We show the existence of a new class of gadgets, using several Linear Code Sequences And Jumps (LCSAJ), undetected by current Galileo-based ROP gadget searching tools. We argue that this class of gadgets is rich enough on RISC-V to mount complex ROP attacks, bypassing traditional mitigation like DEP, ASLR, stack canaries, G-Free, as well as some compiler-based backward-edge CFI, by jumping over any guard inserted by a compiler to protect indirect jump instructions. We provide examples of such gadgets, as well as a proof-of-concept ROP chain, using C code injection to leverage a privilege escalation attack on two standard Linux operating systems. Additionally, we discuss some of the required mitigations to prevent such attacks and provide a new ROP gadget finder algorithm that handles this new class of gadgets.
Fichier non déposé

Dates et versions

hal-03934305 , version 1 (11-01-2023)

Identifiants

  • HAL Id : hal-03934305 , version 1

Citer

Georges-Axel Jaloyan, Konstantinos Markantonakis, Raja Naeem Akram, David Robin, Keith Mayes, et al.. Return-Oriented Programming on RISC-V. AsiaCCS 2020, Jan 2022, Taipei, Taiwan. ⟨hal-03934305⟩
15 Consultations
0 Téléchargements

Partager

Gmail Facebook X LinkedIn More