Thwarting stack-based memory safety violations with stack layout randomization

Abstract

Stack-based memory errors have been a serious source of software vulnerabilities. Although there is a wide spectrum of stack memory defenses proposed, most of them provide limited protection focusing on out-of-bound memory errors or involve unacceptable performance overhead. In this thesis, we explore the feasibility of byte-granularity stack layout randomization and propose SaVioR-E, efficient and comprehensive stack protection. We achieve it through three techniques: (1) isolating out-of-bound-unsafe stack objects, (2) random allocation of stack frames, and (3) introducing byte-granularity randomization by breaking the natural alignment of stack objects. SaVioR-E was implemented on the LLVM compiler infrastructure and evaluated using the SPEC CPU2006 benchmark suite and the Nginx web server. A security analysis was conducted to evaluate the effectiveness of SaVioR-E. The evaluation demonstrates SaVioR-E imposes 22% run-time overhead while achieving adequate legacy compatibility.