Diagnosing and Neutralizing Address-Sensitive Behavior in Multi-Variant Execution Systems

Multi-Variant eXecution (MVX) systems are a potent building block for comprehensive memory corruption defenses. They run multiple diversified variants of the same program in parallel, feed them the same inputs, and monitor whether they produce the same outputs. If applied correctly, MVX systems ensure that (i) no single exploit payload can simultaneously compromise all variants and (ii) any exploit causes an observable divergence in the variants' behavior. After repeatedly demonstrating their prowess in detecting control-flow hijacks, MVX systems are naturally keen to extend their protection to data-only attacks, which do not solely focus on corrupting code pointers. However, that would require diversifying the variants' data layout as well, which vastly exacerbates known compatibility issues of existing systems. Due to Address-Sensitive Behavior (ASB), benign programs can behave in dissimilar but functionally equivalent ways depending on memory layout and address values. This causes variants to diverge in ways that are indistinguishable from the effects of an attack to the MVX monitor. In this paper, we explore the practical implications of adopting data diversification in MVX systems. For the first time, we characterize and quantify the issue of ASB across a wide range of real-world software, and find that it is a significant hurdle towards support for data diversification in MVX. To help address this issue, we developed a new variant diffing technique that allows us to recognize and, at times, even neutralize different classes of ASB by locating address-related data in the variants without compiler support.