_:n9ab092968d2f4255936e662e900db988xb13
<http://schema.org/description>
"Despite extensive testing and correctness certification of their functional\nsemantics, a number of compiler optimizations have been shown to violate\nsecurity guarantees implemented in source code. While prior work has shed light\non how such optimizations may introduce semantic security weaknesses into\nprograms, there remains a significant knowledge gap concerning the impacts of\ncompiler optimizations on non-semantic properties with security implications.\nIn particular, little is currently known about how code generation and\noptimization decisions made by the compiler affect the availability and utility\nof reusable code segments (called gadgets) required to mount code reuse attack\nmethods such as return-oriented programming.\n  In this paper, we bridge this gap through a study of the impacts of compiler\noptimization on code reuse gadget populations. We analyze and compare 1,000\ndifferent variants of 17 different benchmark programs built with two production\ncompilers (GCC and Clang) to determine how compiler optimization affects code\nreuse gadget sets available in program binaries. Our results expose an\nimportant and unexpected problem; compiler optimizations introduce new gadgets\nat a high rate and produce code containing gadgets that are generally more\nuseful to an attacker crafting a code reuse exploit than those in unoptimized\ncode.\n  Using differential binary analysis, we identify several compiler behaviors at\nthe root of this phenomenon. In turn, we show that these impacts can be\nsignificantly mitigated through security-focused post-production software\ntransformation passes. Finally, we provide an analysis of the performance\nimpacts of our proposed mitigations to demonstrate that they are negligible."
<https://deepai.org/profile/girish-mururu>