Typed virtual table for mitigating virtual table hijacking

Abstract

Object-Oriented Programming is essential for the developing the large size program. Object-Oriented Programming has a characteristic, Polymorphism, which is that the called function depends on the type of object. In the C++, there is the reserved word virtual for supporting polymorphism. Because the called function at the virtual function callsite can differ dynamically, the callsite is compiled as an indirect call. Therefore, if attackers change the virtual table pointer in an object, they can hijack the control flow. It is called as virtual table hijacking attack. In this paper, we suggest the new mitigation technique, TVT. TVT saves the type of the object in the constructor and checks that the type is changed at the callsites. We apply TVT to the firefox browser and tiny vulnerable program, and TVT can prevent all known test exploits. It shows reasonable overhead that is up to 48% for the SPEC2017 benchmark and average 20% for the firefox browser. Because the web page loading overhead is about 10%, which is less than network latency, TVT can apply to browsers.