Secure Bit Enhanced Canary: Hardware Enhanced Buffer-Overflow Protection

Piromsopa and Enbody (2006) proposed Secure Bit, an architectural approach to protect against buffer-overflow attacks on control data (return-addresses and function pointers). This paper explores the possibility of extending Secure Bit to protect non-control data (variables, pointers and arrays). A hardware bit, provided by Secure Bit, helps preserving the integrity of an associated address. We propose putting a Canary Word adjacent to variables and using Secure Bit to protect the integrity of this word. In this extension, we introduce a new hardware instruction that is used to validate the Secure Bit of an adjacent word. An important differentiating aspect of Secure Bit is that once a Canary Word (data) has been marked as insecure there is no instruction to remark it as secure. Thus, it is theoretically not possible to bypass the mechanism by overflowing the Canary Word with a valid value. Our preliminary study has shown a promising solution to buffer overflow on arbitrary data. Robustness and performance are demonstrated by emulating the hardware, booting Linux on the emulator, running application software on that Linux, and performing known attacks.