Seminar - Exploiting Memory Errors on the Data Plane

Seminar
 Tuesday, April 12, 10am 222 IST Building

By: Zhenkai Liang National University of Singapore

 “Exploiting Memory Errors on the Data Plane” As defense solutions against control-flow hijacking attacks gain wide deployment, controloriented exploits from memory errors become difficult. As an alternative, attacks targeting noncontrol data do not require diverting the application’s control flow during an attack. Although it is known that such data-oriented attacks can mount significant damage, no systematic methods to automatically construct them from memory errors have been developed. In this work, we study exploits of memory errors from the data angle. We have developed a new technique, called data-flow stitching, which systematically finds ways to join data flows in the program to generate data-oriented exploits. We have constructed new attacks on the data plane from known vulnerabilities. The constructed exploits can cause significant damage, such as disclosure of sensitive information (e.g., passwords and encryption keys) and escalation of privilege. We further study the expressiveness of such data-oriented exploits. By identifying data-oriented gadgets and gadget dispatchers, we demonstrate that data-oriented exploits can be used to construct Turing complete computations.