Heatseeker: Uncovering Dispatcher Gadgets on the Fly

Abstract

Code-reuse attacks (CRAs) have become increasingly sophisticated, constructing malicious payloads by chaining together small fragments of legitimate code, called gadgets. They bypass traditional defenses such as non-executable memory and code integrity checks, by using indirect jumps or calls to orchestrate a behavior not intended by software programmers. Jump-oriented programming (JOP) attacks specifically are a particular threat because their behavior is hardly distinguishable from that of a bug or a legitimate application. In this paper, we present heatseeker, an innovative signature-based detection algorithm specifically designed to identify JOP attacks by analyzing patterns during program execution. Unlike existing mitigation techniques, which impose performance overhead or require substantial changes to system software, this algorithm can be implemented using only a dedicated hardware component working in parallel with the processor. Heatseeker relies on invariants in the JOP execution pattern that are used as signatures, which drastically reduces the dependency on gadget length. We present a proof that the algorithm detects JOP attacks and describe the underlying formalization of JOP attacks and the algorithm. We also propose a proof-of-concept implementation of the algorithm on the CV32A6 platform, an open-source RISC-V CPU supporting a Linux operating system (OS). Our experiments demonstrate the effectiveness of the heatseeker algorithm against JOP payloads as well as its safety against legitimate applications, which we demonstrate through extensive testing under Linux and with SPEC CPU 2017 benchmarks. The heatseeker algorithm provides a practical, binary-agnostic method for detecting JOP attacks, offering robust protection without impacting performance.