Mitigation Techniques

Question 1

Stack Mitigation Techniques

Answer 1

RELRO, NX (Non-eXecutable stack), PIE (Position Independent Executable), Stack Canary

Question 2

How does the stack grows in reference to its addresses?

Answer 2

Grows from high addresses to low addresses

Question 3

Difference between Partial-RELRO vs Full RELRO

Answer 3

Full RELRO populates the GOT (Global Offset Table) at startup and makes it read only. Partial RELRO has the GOT still writable at runtime while other areas are remapped as read only.

Question 4

PIE

Answer 4

Positiion Independent Executable

Question 5

ASLR

Answer 5

Address Space Layout Randomization

Question 6

PIE vs ALSR

Answer 6

ASLR:
Is a feature of the OS.
Randomizes base memory addresses in virtual address space.
PIE:
Is a feature of the binary.
It compiles a binary so it is independent of the base address.

Question 7

Stack Canary

Answer 7

Feature to push a canary to the stack that is checked before returning.

Question 8

Types of Stack Canaries

Answer 8

Static, Random, Terminator

Question 9

Stack Pivot Mitigation Tecniques

Answer 9

Virtual Memory Permission, Hooks

Question 10

Virtual Memory Permission

Answer 10

Enforces that the SP is within a certain memory region at system call entry.

Question 11

Hooks

Answer 11

Runtime security software checks that the SP is within sane bounds at critical functions.

Question 12

ROP Mitigation Tecniques

Answer 12

Control Flow Guard, Return Flow Guard, Indirect Branch Tracking, Pointer Authentication Codes, Shadow Stacks,

Question 13

Control Flow Guard

Answer 13

Software-enforced forward CFI. At compile time it generates a list of valid indirect branch targets. At load time, it creates bitmap storing valid addresses. At runtime, it checks actual addresses against bitmap.

Question 14

Return Flow Guard

Answer 14

Software-enforced back-edge CFI. Enforces that functions return to the address that they were called from. At function prologue, store return address in shadow stack. At function epilogue, compare return address.

Question 15

Problems with Return Flow Guard

Answer 15

Inherent race conditions by another thread overwriting return address on stack before load occurs. Shadow Stack memory is writable.

Question 16

Indirect Branch Tracking

Answer 16

Hardware-enforced forward CFI. It uses a endbr64 instruction to signal a valid indirect call.

Question 17

Pointer Authentication Codes

Answer 17

Hardware-enforced backward CFI. Return address pointer is signed. Link register X30 holds the authentication codes in high bits. Before returning, it authenticates the return address.