next up previous
Next: Introduction

StackGhost: Hardware Facilitated Stack Protection

Mike Frantzen
CERIAS
frantzen@cerias.purdue.edu

Mike Shuey
Engineering Computer Network
shuey@ecn.purdue.edu

Abstract:

Conventional security exploits have relied on overwriting the saved return pointer on the stack to hijack the path of execution. Under Sun Microsystem's Sparc processor architecture, we were able to implement a kernel modification to transparently and automatically guard applications' return pointers.

Our implementation called StackGhost under OpenBSD 2.8 acts as a ghost in the machine. StackGhost advances exploit prevention in that it protects every application run on the system without their knowledge nor does it require their source or binary modification.

We will document several of the methods devised to preserve the sanctity of the system and will explore the performance ramifications of StackGhost.





2001-05-12