jit: Enhance security by Control-Flow Integrity

[jserv]

JIT compilers present unique security challenges due to their complexity and lack of memory safety. These compilers handle untrusted input programs, optimize code, and incorporate components like garbage collectors. Such extensive C/C++ code bases are prone to critical security bugs, evidenced by buffer-overflow vulnerabilities found in engines like Google’s V8 JavaScript engine.

A significant security concern with JIT compilation is the code heap, which is typically writable and executable to allow for online code modification. This is crucial for optimizations like inline caching and on-stack replacement but negates the use of Data Execution Prevention (DEP) on the code heap's memory pages. Consequently, vulnerabilities like heap overflows can be exploited to inject and execute malicious code. Moreover, JIT compilers can be susceptible to a technique called JIT spraying. This involves crafting input programs with specific constants that manipulate the JIT compiler to generate native code containing these constants. Attackers can then redirect control flow to execute these constants as harmful code.

Control-Flow Integrity (CFI) upholds a predetermined Control-Flow Graph (CFG) in a program, particularly for indirect branches like returns, indirect calls, and jumps. It ensures these branches align with the CFG, which is essentially a static approximation of the program’s dynamic flow. Since there can be multiple CFGs for a program, CFI techniques are divided into two categories: coarse-grained and fine-grained.

Fine-grained CFI is more precise, allowing each indirect branch to have its unique target set, thereby greatly enhancing security. This precision is crucial in limiting an attacker's ability to connect Return-Oriented Programming (ROP) gadgets, making it an effective defense against ROP attacks. Various fine-grained CFI techniques have been explored in security research, offering advanced protection by closely monitoring and validating the control flow of a program. We can apply fine-grained CFI on the JIT compiler and therefore provides stronger security. Software diversification has been used to mitigate JIT spraying attacks.

Reference:

• RockJIT: Securing Just-In-Time Compilation Using Modular Control-Flow Integrity
• Renewable Just-In-Time Control-Flow Integrity
• Control-flow Integrity in V8