Speculation-Free Function Table Construction in LLVM IR for Fine-Grained Control Flow Integrity

Abstract

Securing the operating system kernel is the key to overall system security. Due to developer negligence and the inherent limitations of the code language, kernel data is exposed to various security risks, such as execution flow leakage and privilege hijacking. In binary security, most vulnerabilities are exploited by hijacking the control flow to make the program run according to the attacker’s idea of attack. Control flow integrity is a common defense scheme against control flow hijacking attacks. In this paper, we use speculation-free function tables in LLVM IR to achieve the integrity of fine-grained control flow. The technique enforces CFI policies by making logical judgments on jump instruction stubbing. All jump instructions share a common function table, and the information in the table is not repeatedly stored, reducing the additional memory consumption caused by the function table and achieving fine-grained CFI protection.