RockJIT: Securing Just-In-Time Compilation Using Modular Control-Flow Integrity

Managed languages such as JavaScript are popular. For perfor-mance, modern implementations of managed languages adopt Just-In-Time (JIT) compilation. The danger to a JIT compiler is that an attacker can often control the input program and use it to trigger a vulnerability in the JIT compiler to launch code injection or JIT spraying attacks. In this paper, we propose a general approach called RockJIT to securing JIT compilers through Control-Flow Integrity (CFI). RockJIT builds a fine-grained control-flow graph from the source code of the JIT compiler and dynamically up-dates the control-flow policy when new code is generated on the fly. Through evaluation on Google’s V8 JavaScript engine, we demon-strate that RockJIT can enforce strong security on a JIT compiler, while incurring only modest performance overhead (14.6 % on V8) and requiring a small amount of changes to V8’s code. Key con-tributions of RockJIT are a general architecture for securing JIT compilers and a method for generating fine-grained control-flow graphs from C++ code