MemGuard StackGuard Overhead

 

The MemGuard variant of StackGuard suffers substantial performance penalties compared to the Canary variant, for reasons described in Section 3.2. Section 4.1 showed that the MemGuard variant provides better security protection for stack attacks than the Canary variant (specifically, MemGuard stopped the SuperProbe attack, and guessing canary values will not help get past MemGuard). This section measures the cost of that added protection.

The MemGuard variant of StackGuard is still under development, but as of this writing, we have some preliminary results. We have measured the performance of two versions of MemGuard StackGuard:

MemGuard Register

This version uses only the Pentium's debugging registers for protection, so only the four most recent function calls' return addresses are protected. This version pays no penalty for page protection faults induced by protecting the stack with virtual memory protection. NOTE: this version stopped all of the stack smashing attacks that we tested.

MemGuard VM

This version uses the virtual memory page protection scheme described in Section 3.2. It has not fully exploited the optimization of using the debugging registers as a cache, to keep the top page of the stack writable. Thus this version suffers substantial performance penalties due to a large number of page protection faults.

 

Increment Standard MemGuard Register % MemGuard VM %

Method Run-Time Run-Time Overhead Run-Time Overhead

i++ 15.1 15.1 NA NA NA

void inc() 35.1 1808 8800% 34,900 174,300%

void inc(int *) 47.7 1820 5400% 40,420 123,800%

int inc(int) 40.1 1815 7000% 41,610 166,200%

 

Table 3 shows the overhead costs for the MemGuard variant of StackGuard. Because of the use of a heavy-weight system call to access privileged hardware for protection, function calls slow down by for the MemGuard Register protection. The additional penalty of page protection fault handling for false sharing of the page on the top of the stack raises the cost of function calls by . Proper use of the debugging registers as a cache for the VM mechanism should bring the costs in line with the MemGuard Register costs.