2023/03/28 by Alexander J. Gaidis, J. Moreira, Gaidis, Alexander J. +9 · 1 citation
Computer Science · #Advanced Data Storage Technologies #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Parallel Computing and Optimization Techniques #Security and Verification in Computing
paper · pdf · doi:10.48550/arxiv.2303.16353
openalex publication_date 2023/03/28 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
We present the design, implementation, and evaluation of FineIBT: a CFI enforcement mechanism that improves the precision of hardware-assisted CFI solutions, like Intel IBT, by instrumenting program code to reduce the valid/allowed targets of indirect forward-edge transfers. We study the design of FineIBT on the x86-64 architecture, and implement and evaluate it on Linux and the LLVM toolchain. We designed FineIBT's instrumentation to be compact, incurring low runtime and memory overheads, and generic, so as to support different CFI policies. Our prototype implementation incurs negligible runtime slowdowns (≈0%-1.94% in SPEC CPU2017 and ≈0%-1.92% in real-world applications) outperforming Clang-CFI. Lastly, we investigate the effectiveness/security and compatibility of FineIBT using the ConFIRM CFI benchmarking suite, demonstrating that our instrumentation provides complete coverage in the presence of modern software features, while supporting a wide range of CFI policies with the same, predictable performance.