StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks

Authors

Crispin Cowan, Oregon Graduate Institute of Science & TechnologyFollow
Calton Pu, Oregon Graduate Institute of Science & TechnologyFollow
David Maier, Oregon Graduate Institute of Science & TechnologyFollow
Heather Hinton
Jonathan Walpole, Oregon Graduate Institute of Science & TechnologyFollow
Peat Bakke, Oregon Graduate Institute of Science & Technology
Steve Beattie, Oregon Graduate Institute of Science & Technology
Aaron Grier, Oregon Graduate Institute of Science & Technology
Perry Wagle, Oregon Graduate Institute of Science & TechnologyFollow
Qian Zhang, Oregon Graduate Institute of Science & TechnologyFollow

Sponsor

This research is partially supported by DARPA contracts F30602-96-1-0331 and F30602-96-1-0302.

Published In

Proceedings of the 7th USENIX Security Symposium

Document Type

Conference Proceeding

Publication Date

1-1998

Subjects

Computer viruses -- Prevention, Computer security -- Innnovations, Operating systems (Computers) -- Design and construction, Computer networks -- Security measures

Abstract

This paper presents a systematic solution to the persistent problem of buffer overflow attacks. Buffer overflow attacks gained notoriety in 1988 as part of the Morris Worm incident on the Internet. While it is fairly simple to fix individual buffer overflow vulnerabilities, buffer overflow attacks continue to this day. Hundreds of attacks have been discovered, and while most of the obvious vulnerabilities have now been patched, more sophisticated buffer overflow attacks continue to emerge.

We describe StackGuard: a simple compiler technique that virtually eliminates buffer overflow vulnerabilities with only modest performance penalties. Privileged programs that are recompiled with the StackGuard compiler extension no longer yield control to the attacker, but rather enter a fail-safe state.

These programs require no source code changes at all, and are binary-compatible with existing operating systems and libraries. We describe the compiler technique (a simple patch to gcc), as well as a set of variations on the technique that tradeoff between penetration resistance and performance. We present experimental results of both the penetration resistance and the performance impact of this technique.

Description

Permission has been granted by the USENIX Association to reprint this paper. This paper was originally published in the USENIX Association Conference Proceedings, vol. 81, pp. 346-355. 1998. ©USENIX Association, 1998.

Persistent Identifier

http://archives.pdx.edu/ds/psu/10638

Citation Details

Cowan, Crispin, Calton Pu, Dave Maier, Heather Hinton, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, and Qian Zhang. "StackGuard: Automatic adaptive detection and prevention of buffer-overflow attacks." In Proceedings of the 7th USENIX Security Symposium, vol. 81, pp. 346-355. 1998.