Ret-gadgets in RISC-V-based Binaries Resulting in Traps for Hijackers

Abstract

The presence of instructions within executable programs is what makes the binaries executable.  However, attackers leverage on the same to achieve some form of Control Flow Hijacking (CFH).  Such code re-use attacks have also been found to lead to Denial of Service (DoS).  An example of code re-use attack is Return Oriented Programming (ROP) which is caused by passing input crafted as chained sequences of instructions that are already existing as subroutines in the target program.  The instructions are called gadgets and they would normally end with ret.  The ret instructions enable the flow of hijacked execution from one set of instruction to another within the attacker’s control.  There could however be exceptions depending on the structure of the chained gadgets  where the chained gadget fails to run its course due to inability of specific gadgets to replace the value in the return address (ra) register. The dangers of chained gadgets are not a new idea but the possibility for an attacker’s gadget chain to fall into a trap during a ROP attack is not commonly addressed.  In addition to this, recent studies have revealed that understanding the behaviours of gadgets would be useful for building information base in training machine learning (ML) models to combat ROP.  This study explains the behaviour of certain ROP gadgets showing the possibility of occurrence of a loop in execution during exploitation.  A sample program which accesses gadgets from the GNU C library (glibc) is used to demonstrate the findings.  Gadgets identified with this possibility are poor for chaining as they do not contain instructions to load or move new values to the ra register and would produce unreliable exploits.  This would result in a trap for the chained gadgets instead of arbitrary code execution, and DoS on the path of the user.  This implies that the impact that a ROP chain could have on a targeted process does not only rely on the underlying system architecture but also on relies on the structure of the chained gadget.  In this paper, the RISC-V architecture is the focus, new gadget finders (scripts are available) are presented, and sample of chained gadgets are analysed on a RISC-V -based binary.