Thread-Level Attack-Surface Reduction

LCTES Conference B
Thread-Level Attack-Surface Reduction
Florian Rommel, Christian Dietrich, Andreas Ziegler, Illia Ostapyshyn, Daniel LohmannProceedings of the 24th ACM SIGPLAN/SIGBED International Conference on Languages, Compilers, and Tools for Embedded SystemsACM Press2023.
PDF Details Slides Video 10.1145/3589610.3596281 [BibTex]

Projects: ATLAS, CADOS


Existing debloating techniques designed to prevent buffer-overflow exploits through return-oriented programming do not differentiate roles within a process or binary, allowing all threads access to the full program functionality. For example, a worker thread that handles client connections (highest attack exposure) still has access to all the code that the management thread needs (highest potential fallout).

We introduce thread-level attack-surface reduction (TLASR), a dynamic, context-aware approach that eliminates unused code on a thread level. For this, we (permanently or temporarily) eliminate parts of the text segment (both in shared libraries and the main binary) and use the mmview Linux extension to support multiple text-segment views in a single process. We reduce the executable code visible from a single thread in MariaDB, Memcached, OpenSSH, and Bash by 84 to 98.4 percent. As a result, the number of ROP gadgets decreases significantly (78–97%), with TLASR rendering an auto-ROP utility ineffective in all investigated benchmarks and eliminating all CVE-related functions ever reported for glibc in 97 percent of the cases.

Source Code

The CTE source code and the Linux mmview extension are available on Github: CTE, Linux mmview.


To obtain the raw data of the evaluation results and the necessary programs and scripts to reproduce the experiments and analyses of the paper, please refer to the published artifact.

ACM Artifacts Available V1.1 ACM Artifacts Evaluated Functional V1.1 ACM Results Reproduced V1.1