MITIGATION OF STACK CORRUPTION EXPLOITS

    公开(公告)号:EP3198506A4

    公开(公告)日:2018-05-30

    申请号:EP15844964

    申请日:2015-08-26

    申请人: MCAFEE LLC

    发明人: CROWE SIMON

    IPC分类号: G06F21/54 G06F21/52 G06F21/56

    CPC分类号: G06F21/54 G06F2221/033

    摘要: In an example, a stack protection engine is disclosed for preventing or ameliorating stack corruption attacks. The stack protection engine may operate transparently to user-space processes. After a call to a subroutine from a parent routine, the stack protection engine encodes the return address on the stack, such as with an exclusive or cipher and a key selected from a key array. After the subroutine returns control to the main routine, the stack protection engine decodes the address, and returns control. If a stack corruption attack occurs, the malicious return address is not properly encoded, so that when decoding occurs, the program may simply crash rather than returning control to the malicious code.