CCFI

CCFI

Cryptographically Enforced Control Flow Integrity


Control Flow Integrity is a principled approach for defending against control hijacking attacks. Previous approaches have been limited by the complexity of static analysis, and are overly permissive. CCFI is the first use of the cryptographic hardware present in modern processors to implement a CFI system. A CCFI enabled compiler inserts code to generate MACs and verify a hash of critical pointers.

CCFI Source Code

CCFI is implemented as a modified Clang/LLVM compiler with a single line change to the FreeBSD system libraries. We provide the compiler and scripts necessary to build CCFI compatible system libraries. The current implementation is an LLVM IR pass which is great for prototyping and experimentation. We hope to provide machine pass as our final implementation to provide better control over code generation.

You can download and install from source now.
CCFI

People

Publications

Ali Jose Mashtizadeh, Andrea Bittau, Dan Boneh, David Mazières. CCFI: Cryptographically Enforced Control Flow Integrity. In Proceedings of 22nd ACM Conference on Computer and Communications Security. (PDF to be available soon)
Ali Jose Mashtizadeh, Andrea Bittau, David Mazières, Dan Boneh. Cryptographically Enforced Control Flow Integrity. In arXiv. Paper

Contact

Please report bugs on bitbucket. You will need a bitbucket account to create a ticket.