Execution at RISC: Stealth JOP Attacks on RISC-V Applications
Abstract
RISC-V is a recently developed open instruction set architecture gaining a lot of attention. To achieve a lasting security on these systems and design efficient countermeasures, a better understanding of vulnerabilities to novel and potential future attacks is mandatory. This paper demonstrates that RISC-V is sensible to Jump-Oriented Programming, a class of complex code-reuse attacks. We provide an analysis of new dispatcher gadgets we discovered, and show how they can be used together in order to build a stealth attack, bypassing existing protections. A proof-of-concept attack is implemented on an embedded web server compiled for RISC-V, in which we introduced a vulnerability, allowing an attacker to remotely read an arbitrary file from the host machine.
- Publication:
-
arXiv e-prints
- Pub Date:
- July 2023
- DOI:
- 10.48550/arXiv.2307.12648
- arXiv:
- arXiv:2307.12648
- Bibcode:
- 2023arXiv230712648B
- Keywords:
-
- Computer Science - Cryptography and Security;
- Computer Science - Software Engineering;
- 68M25;
- D.4.6
- E-Print:
- 16 pages. arXiv admin note: text overlap with arXiv:2211.16212