sesa 15(4): e3

Research Article

Separated Control and Data Stacks to Mitigate Buffer Overflow Exploits

Download1140 downloads
  • @ARTICLE{10.4108/eai.5-10-2015.150477,
        author={Christopher  Kugler and Tilo  M\'{y}ller},
        title={Separated Control and Data Stacks to Mitigate Buffer Overflow Exploits},
        journal={EAI Endorsed Transactions on Security and Safety},
        keywords={Stack-based Buffer Overflows, LLVM, Separate Control Stack},
  • Christopher Kugler
    Tilo Müller
    Year: 2015
    Separated Control and Data Stacks to Mitigate Buffer Overflow Exploits
    DOI: 10.4108/eai.5-10-2015.150477
Christopher Kugler1, Tilo Müller1,*
  • 1: Department of Computer Science, Friedrich-Alexander-University of Erlangen-Nuremberg, Germany
*Contact email:


Despite the fact that protection mechanisms like StackGuard, ASLR and NX are widespread, the development on new defense strategies against stack-based buffer overflows has not yet come to an end. In this article, we present a novel compiler-level protection called SCADS: Separated Control and Data Stacks that protects return addresses and saved frame pointers on a separate stack, called the control stack. In common computer programs, a single user mode stack is used to store control information next to data buffers. By separating control information from the data stack, we can protect sensitive pointers of a program’s control flow from being overwritten by buffer overflows. To substantiate the practicability of our approach, we provide SCADS as an open source patch for the LLVM compiler infrastructure. Focusing on Linux and FreeBSD running on the AMD64 architecture, we show compatibility, security and performance results. As we make control flow information simply unreachable for buffer overflows, many exploits are stopped at an early stage of progression with only negligible performance overhead.