|
7th USENIX Security Symposium, San Antonio, Texas
StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks
Crispan Cowan, Calton Pu, Dave Maier, Jonathan Walpole, Peat Bakke, Steve
Beattie, Aaron Grier, Perry Wagle, and Qian Zhang, Oregon Graduate Institute of Science & Technology;
Heather Hinton, Ryerson Polytechnic University
Abstract
This paper presents a systematic solution to the persistent problem of
buffer overflow attacks. Buffer overflow attacks gained notoriety in
1988 as part of the Morris Worm incident on the Internet. While it is
fairly simple to fix individual buffer overflow vulnerabilities, buffer
overflow attacks continue to this day. Hundreds of attacks have been
discovered, and while most of the obvious vulnerabilities have now been
patched, more sophisticated buffer overflow attacks continue to emerge.
We describe StackGuard: a simple compiler technique that virtually
eliminates buffer overflow vulnerabilities with only modest performance
penalties. Privileged programs that are recompiled with the StackGuard
compiler extension no longer yield control to the attacker, but
rather enter a fail-safe state. These programs require no
source code changes at all, and are binary-compatible with existing
operating systems and libraries. We describe the compiler technique
(a simple patch to gcc), as well as a set of variations on the
technique that trade-off between penetration resistance and performance.
We present experimental results of both the penetration resistance and
the performance impact of this technique.
- View the full text of this paper in
HTML form and
PDF form.
- If you need the latest Adobe Acrobat Reader, you can download it from Adobe's site.
- To become a USENIX Member, please see our Membership Information.
|
Need help? Use our Contacts page.
Technical Program