Silhouette: Efficient Protected Shadow Stacks for Embedded Systems

Microcontroller-based embedded systems are increasingly used for applications that can have serious and immediate consequences if compromised--including automobile control systems, smart locks, drones, and implantable medical devices. Due to resource and execution-time constraints, C is the primary language used for programming these devices. Unfortunately, C is neither type-safe nor memory-safe, and control-flow hijacking remains a prevalent threat. This paper presents Silhouette: a compiler-based defense that efficiently guarantees the integrity of return addresses--significantly reducing the attack surface for control-flow hijacking. Silhouette provides an incorruptible shadow stack for return addresses using special store instructions found on ARM processors. Specifically, Silhouette transforms regular store instructions into unprivileged equivalents, restricting the untrusted subset of the program's memory accesses to unprivileged memory while simultaneously allowing security instrumentation to access security-critical data structures--all without the need for expensive context switching, hardware changes, or information hiding. Combined with its checks on forward control flow and memory access configuration, Silhouette ensures that all functions return to the correct caller. We implemented Silhouette for the ARMv7-M architecture, but our techniques are applicable to other common embedded ARM architectures. Our evaluation shows that Silhouette incurs a geometric mean of 1.2% and 3.6% performance overhead on two benchmark suites. Furthermore, we prototyped Silhouette-Invert, an alternative implementation of Silhouette, which incurs just 0.2% and 1.9% performance overhead, at the cost of a minor hardware change.