Umeå University's logo

umu.sePublications
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Lessons learned and challenges of deploying control flow integrity in complex software: the case of OpenJDK's java virtual machine
Umeå University, Faculty of Science and Technology, Department of Computing Science.
Umeå University, Faculty of Science and Technology, Department of Computing Science.ORCID iD: 0000-0003-1383-0372
2024 (English)In: Proceedings - 2024 IEEE Secure Development Conference, SecDev 2024, Institute of Electrical and Electronics Engineers (IEEE), 2024, p. 153-165Conference paper, Published paper (Refereed)
Abstract [en]

This research explores integrating LLVM's Control Flow Integrity (CFI) into the OpenJDK Java Virtual Machine (JVM) to mitigate memory corruption vulnerabilities. We present a manual approach to CFI integration that offers a solution applicable to various real-world projects. Using the DaCapo benchmark suite, we conduct a thorough performance evaluation of the CFI-integrated JVM version. Our work reveals that introducing CFI results in an average performance overhead of approximately 11.5% and a 34% increase in binary size. Remarkably, we identify specific CFI subcategories that, when implemented individually, induce performance improvements for the JVM. This finding highlights CFI's potential to enhance security and performance in Java and general applications. Our research advances the understanding of CFI integration in complex software such as the JVM, shedding light on the challenges and opportunities in securing software systems against memory corruption attacks.

Place, publisher, year, edition, pages
Institute of Electrical and Electronics Engineers (IEEE), 2024. p. 153-165
Keywords [en]
C/C++ vulnerabilities, cfi, control flow integrity, jvm, memory corruption, security methodology
National Category
Computer Sciences
Identifiers
URN: urn:nbn:se:umu:diva-232765DOI: 10.1109/SecDev61143.2024.00020ISI: 001348939600015Scopus ID: 2-s2.0-85210576918ISBN: 9798350342482 (electronic)OAI: oai:DiVA.org:umu-232765DiVA, id: diva2:1922872
Conference
2024 IEEE Secure Development Conference, SecDev 2024, Pittsburgh, USA, 7 October 2024through 9 October 2024.
Available from: 2024-12-19 Created: 2024-12-19 Last updated: 2025-04-24Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Houy, SabineBartel, Alexandre

Search in DiVA

By author/editor
Houy, SabineBartel, Alexandre
By organisation
Department of Computing Science
Computer Sciences

Search outside of DiVA

GoogleGoogle Scholar

doi
isbn
urn-nbn

Altmetric score

doi
isbn
urn-nbn
Total: 116 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf