The implementation of Secure Canary Word for buffer-overflow protection
Sirisara Chiamwongpaet, Krerk Piromsopa · 2009
Chiamwongpaet and Piromsopa introduced secure canary word, an extension of secure bit, as an architectural approach to the protection against buffer-overflow attacks on non-control data (variables and arguments). Secure canary word is based on two existing schemes, secure bit and canary word. The objective of this paper is to propose a new hardware implementation in order to improve the efficiency of secure canary word. To evaluate this design, the hardware simulation is conducted using BOCHS emulator running Linux (Red Hat 6.2) with GCC compiler. Like the prior work, the results confirm that secure canary word can detect buffer-overflow attacks on non-control data. Furthermore, performance is significantly better than the original implementation. This suggests that secure canary word can prevent buffer-overflow attacks on non-control data without any serious performance degradation or storage requirement.