Sciweavers

Share
NDSS
2015
IEEE

Too LeJIT to Quit: Extending JIT Spraying to ARM

4 years 9 months ago
Too LeJIT to Quit: Extending JIT Spraying to ARM
Abstract—In the face of widespread DEP and ASLR deployment, JIT spraying brings together the best of code injection and code reuse attacks to defeat both defenses. However, to date, JIT spraying has been an x86-only attack thanks to its reliance on variable-length, unaligned instructions. In this paper, we finally extend JIT spraying to a RISC architecture by introducing a novel technique called gadget chaining, whereby high level code invokes short sequences of unintended and intended instructions called gadgets just like a function call. We demonstrate gadget chaining in an end-to-end JIT spraying attack against WebKit’s JavaScriptCore JS engine on ARM and found that existing JIT spray mitigations that were sufficient against the x86 version of the JIT spraying attack fall short in the face of gadget chaining.
Wilson Lian, Hovav Shacham, Stefan Savage
Added 15 Apr 2016
Updated 15 Apr 2016
Type Journal
Year 2015
Where NDSS
Authors Wilson Lian, Hovav Shacham, Stefan Savage
Comments (0)
books