Return-oriented programming feasible on commercial processing-in-memory architectures
Original title: PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures
PIMROP demonstrates ROP on UPMEM DPU with 517 gadgets and two end-to-end attacks; standard defenses fail.
Processing-in-Memory allows code execution beside DRAM beyond host defenses. Paper shows ROP feasible on commercial UPMEM DPU using custom gadget scanner. Runtime library yields 517 gadgets. Stack overflow and gadget chain attacks demonstrated. Bounds-checked DMA stops attacks.
- 517 non-trivial gadgets in runtime library
- All 13 PrIM benchmarks carry gadgets
- Stack buffer overflow diverts control
- Gadget chain leaks secret without routine
- Bounds-checked DMA stops attacks
From the original article
1 min read at arxiv.orgProcessing-in-Memory places small programmable cores on the memory device, where they execute beside the DRAM banks and beyond the control-flow defenses that protect host programs. The security of this in-memory code is an attack surface that remains largely unstudied. We present PIMROP, to our knowledge the first demonstrated code-reuse attack on a commercial Processing in-Memory ISA.
By William C. Tegge · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.