Check out the new USENIX Web site. next up previous
Next: StackGuard Macrobenchmarks Up: StackGuard Overhead Previous: Canary StackGuard Overhead

MemGuard StackGuard Overhead


The MemGuard variant of StackGuard suffers substantial performance penalties compared to the Canary variant, for reasons described in Section 3.2. Section 4.1 showed that the MemGuard variant provides better security protection for stack attacks than the Canary variant (specifically, MemGuard stopped the SuperProbe attack, and guessing canary values will not help get past MemGuard). This section measures the cost of that added protection.

The MemGuard variant of StackGuard is still under development, but as of this writing, we have some preliminary results. We have measured the performance of two versions of MemGuard StackGuard:

MemGuard Register
This version uses only the Pentium's debugging registers for protection, so only the four most recent function calls' return addresses are protected. This version pays no penalty for page protection faults induced by protecting the stack with virtual memory protection. NOTE: this version stopped all of the stack smashing attacks that we testedgif.
MemGuard VM
This version uses the virtual memory page protection scheme described in Section 3.2. It has not fully exploited the optimization of using the debugging registers as a cache, to keep the top page of the stack writable. Thus this version suffers substantial performance penalties due to a large number of page protection faults.


Increment Standard MemGuard Register % MemGuard VM %
Method Run-Time Run-Time Overhead Run-Time Overhead
i++ 15.1 15.1 NA NA NA
void inc() 35.1 1808 8800% 34,900 174,300%
void inc(int *) 47.7 1820 5400% 40,420 123,800%
int inc(int) 40.1 1815 7000% 41,610 166,200%
Table 3: Microbenchmark: MemGuard Function Call Overhead


Table 3 shows the overhead costs for the MemGuard variant of StackGuard. Because of the use of a heavy-weight system call to access privileged hardware for protection, function calls slow down by tex2html_wrap_inline875 for the MemGuard Register protection. The additional penalty of page protection fault handling for false sharing of the page on the top of the stack raises the cost of function calls by tex2html_wrap_inline877 . Proper use of the debugging registers as a cache for the VM mechanism should bring the costs in line with the MemGuard Register costs.

next up previous
Next: StackGuard Macrobenchmarks Up: StackGuard Overhead Previous: Canary StackGuard Overhead

Crispin Cowan
Tue Dec 9 16:04:30 PST 1997