论文标题
RISC的控制流完整性：通过跳跃的编程攻击RISC-V
Control-Flow Integrity at RISC: Attacking RISC-V by Jump-Oriented Programming
论文作者
论文摘要
RISC-V是一种为嵌入式实时系统开发的开放指令集体系结构。为了在这些系统上实现持久的安全性并设计有效的对策，必须更好地了解新颖和潜在的未来攻击脆弱性。本文表明，RISC-V对跳跃的编程是明智的，这是一类复杂的代码复制攻击，能够绕过现有保护措施。我们对RISC-V系统的攻击表面通过此类攻击提供了首次分析，并展示如何将它们链接在一起以建立成熟的攻击。我们以一种称为保留寄存器的方法对被剥削的登记册和指导模式使用保守的假设。这种方法是在脆弱的RISC-V应用程序上实施的，并成功地应用了AES256秘密。
RISC-V is an open instruction set architecture recently developed for embedded real-time systems. To achieve a lasting security on these systems and design efficient countermeasures, a better understanding of vulnerabilities to novel and potential future attacks is mandatory. This paper demonstrates that RISC-V is sensible to Jump-Oriented Programming, a class of complex code-reuse attacks, able to bypass existing protections. We provide a first analysis of RISC-V systems' attack surface exploitable by such attacks, and show how they can be chained together in order to build a full-fledged attack. We use a conservative hypothesis on exploited registers and instruction patterns, in an approach we called reserved registers. This approach is implemented on a vulnerable RISC-V application, and successfully applied to expose an AES256 secret.
