Selective checking of shared library calls for security

Abstract

This paper presents a systematic solution to the persistent problem of return-into type attacks. A large class of security mechanisms has been defeated by those attacks. While some security mechanisms are concerned with preventing return-into type attacks, they, however, are not complete against return-into type attacks or occur the considerable performance decline. We describe the selective checking of shared library calls, called SCC. The SCC dynamically relocates a program’s Global Offset Table (GOT) and checks whether the accesses via Procedure Linkage Table (PLT) are legal. The SCC is implemented by modifying only the Linux dynamic loader, hence it is transparent to applications and easily deployable. In experiment results, we show that the SCC is effective in defeating against return-into type attacks and is the mechanism with the low start-up and runtime overhead.