SCADS Separated Control- and Data-Stacks
Christopher Kugler, Tilo Müller · 2014
Despite the fact that protection mechanisms like StackGuard, ASLR and NX are widespread, the development on new defense strategies against stack-based buer overows has not yet come to an end. In this paper, we present a compiler-level protection called SCADS: Separated Control- and Data-Stacks. In our approach, we protect return addresses and saved frame pointers on a separate stack, called the Control-Stack (CS). In common computer programs, a single user mode stack is used to store control information next to data buers. By separating control information from the Data-Stack (DS), we protect sensitive pointers of a program's control ow from being overwritten by buer overows. As we make control ow information simply unreachable for buer overows, many exploits are stopped at an early stage of progression with only little performance overhead. To substantiate the practicability of our approach, we provide SCADS as an open source patch for the LLVM compiler infrastructure for AMD64 hosts.