April 11: Software Security and Control-Flow Integrity -- Ulfar Erlingsson

Software Security and Control-Flow Integrity
Ulfar Erlingsson
Microsoft Research

Presented by the Computer Science Student Association
University of Vermont
http://www.cs.uvm.edu/~cssa/

Votey 367, April 11, 2005 12:20 - 1:10pm.

Abstract:

    Current software attacks often build on exploits that subvert
    machine-code execution.  The enforcement of a basic safety property,
    Control-Flow Integrity (CFI), can prevent such attacks from arbitrarily
    controlling program behavior.

    CFI enforcement is simple, and its guarantees can be established
    formally, even with respect to powerful adversaries. Moreover, CFI
    enforcement is practical: it is compatible with existing software and
    can be efficiently implemented.  Finally, CFI guarantees are a useful
    foundation for analysis, processing, and the establishment of further
    properties of the software.

    CFI derives its security benefits from constraining low-level machine
    operations to conform more closely to the high-level programming
    language semantics.  CFI generalizes, or can subsume, popular
    mechanisms for reducing this discrepancy between the hardware and
    software semantics.

This talk will be open to the public and free of admission.  Please feel
free to distribute this announcement where appropriate.