Abstract:Buffer overflow vulnerabilities are widely present in programs written in insecure high-level languages. By exploiting buffer overflow vulnerabilities, attackers can carry out dangerous attacks such as control flow hijacking. Canary-based stack smashing protection is a simple, effective, and widely deployed defense mechanism against buffer overflow vulnerabilities. However, its characteristics of fixed locations and identical values make it susceptible to analysis and exploitation by attackers. This study proposes a stack smashing protection approach based on software diversity, which features heterogeneous Canary with randomized sizes and offsets. This approach not only directly defends against leakage and overwrite attacks that conventional Canary cannot handle, but also enables the construction of various diversified software systems with more security. Experimental results show that this technology introduces less than 2% compilation overhead and an average of 3.22% runtime overhead for the SPEC CPU 2017 benchmark set while effectively improving security.