Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization

TLDR

Fine‑grained address space layout randomization (ASLR) has recently been proposed as an efficient method to mitigate runtime attacks. This paper introduces a framework for just‑in‑time code reuse that undermines the benefits of fine‑grained ASLR. The framework repeatedly abuses a memory disclosure to map an application’s layout on‑the‑fly, dynamically discovers API functions and gadgets, and JIT‑compiles the target program using those gadgets within a script environment at exploit launch. Using the framework against a real‑world Internet Explorer exploit and extensive evaluations, we show that fine‑grained ASLR may not be as promising as previously thought.

Abstract

Fine-grained address space layout randomization (ASLR) has recently been proposed as a method of efficiently mitigating runtime attacks. In this paper, we introduce the design and implementation of a framework based on a novel attack strategy, dubbed just-in-time code reuse, that undermines the benefits of fine-grained ASLR. Specifically, we derail the assumptions embodied in fine-grained ASLR by exploiting the ability to repeatedly abuse a memory disclosure to map an application's memory layout on-the-fly, dynamically discover API functions and gadgets, and JIT-compile a target program using those gadgets -- all within a script environment at the time an exploit is launched. We demonstrate the power of our framework by using it in conjunction with a real-world exploit against Internet Explorer, and also provide extensive evaluations that demonstrate the practicality of just-in-time code reuse attacks. Our findings suggest that fine-grained ASLR may not be as promising as first thought.