In code reuse attacks, attackers exploit retentivity corruption bugs (buffer overflows, type confusion, or integer overflows) to accept over code pointers stored inwards retentivity together with repurpose existing code inwards a means that directs command catamenia of their choice, resulting inwards a malicious action.
Since Android has a lot of mitigation to forbid straight code injection into its kernel, this code reuse method is peculiarly pop alongside hackers to gain code execution with the amount because of the huge publish of role pointers it uses.
In an effort to forbid this attack, Google has right away added back upwards for LLVM’s Control Flow Integrity (CFI) to Android's amount every bit a stair out for detecting odd behaviors of attackers trying to interfere or alter the command catamenia of a program.
"CFI attempts to mitigate these attacks past times adding additional checks to confirm that the kernel's command catamenia stays inside a precomputed graph," said Sami Tolvanen, Android Security Staff Software Engineer.
"This doesn't forbid an assaulter from changing a role pointer if a põrnikas provides write access to one, exactly it significantly restricts the valid telephone hollo upwards targets, which makes exploiting such a põrnikas to a greater extent than hard inwards practice."
The extra checks added past times CFI volition brand certain that apps or programs with odd conduct volition last automatically aborted.
Control-Flow Integrity Added to Android Kernel 4.9 together with 4.14
According to Google, Google Pixel iii launched before this calendar week is the kickoff Android device to integrate the novel amount code protection system.
However, CFI back upwards has right away been added to Android kernel versions 4.9 together with 4.14, together with Google recommends all Android device vendors to enable the characteristic inwards the amount of their novel arm64 devices running Android ix for additional protection against amount vulnerabilities.
"LLVM's CFI protects indirect branches against attackers who care to gain access to a role pointer stored inwards amount memory," Tolvanen concluded. "This makes a mutual method of exploiting the amount to a greater extent than difficult."
Google too plans to protect role render addresses from like attacks past times adding LLVM's Shadow Call Stack inwards an upcoming compiler release.
