A New Mechanism for OS Security: Selective Checking of Shared Library Calls for Security

This paper presents a systematic solution to the serious problem of GOT/PLT exploitation attacks. A large class of security mechanisms has been defeated by those attacks. While some security mechanisms are concerned with preventing GOT/PLT exploitation attacks, however, they are not complete against GOT/PLT exploitation attacks or the considerable performance decline occurs. We describe the selective checking of shared library calls, called SCC. The SCC dynamically relocates a program’s Global Offset Table (GOT) and checks whether the accesses via Procedure Linkage Table (PLT) are legal. The SCC is implemented by modifying only the Linux dynamic loader, hence it is transparent to applications and easily deployable. In experiment results, we show that the SCC is effective in defeating against GOT/PLT exploitation attacks and is the mechanism with the very low runtime overhead.