WarpGuard: Protected-Site Control-Flow Integrity for CUDA SASS Binaries
WarpGuard is the first Control-Flow Integrity (CFI) system designed for CUDA device binaries that operates directly on executed SASS instructions to enforce protected-site policies, effectively detecting and preventing both backward- and forward-edge control-flow corruption attacks.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a high-performance GPU (Graphics Processing Unit) as a massive, hyper-fast factory. Inside this factory, thousands of tiny workers (called "threads") are building complex products simultaneously. The instructions they follow are written in a secret, ultra-compact code called SASS. This is the "real" language the machine understands, not the human-readable code the programmers wrote.
The problem is that if a bad actor manages to sneak a typo or a corrupted piece of data into the factory's supply chain (a memory bug), they can trick these workers into doing something dangerous. Instead of just building a widget, a worker might be tricked into grabbing a different set of instructions, jumping to a dangerous part of the factory, or handing over the keys to the whole building. This is called a Control-Flow Hijack.
WARPGUARD is a new security system designed to stop this, but with a very specific twist: it doesn't try to fix the supply chain errors; it guards the exit doors where the workers decide where to go next.
Here is how WARPGUARD works, broken down into simple concepts:
1. The "Post-Office" Analogy
Think of the GPU workers as mail carriers.
- The Bug: A hacker slips a fake address into a package (memory corruption).
- The Danger: The mail carrier picks up the package and is about to drive to that fake address.
- The Old Way: You might try to scan every single package before it leaves the factory floor. This is slow and often misses things because the factory is so complex.
- WARPGUARD's Way: WARPGUARD stands at the exit gate. Before the mail carrier leaves the factory to drive to a new address, WARPGUARD checks their clipboard.
- Backward Edge (Returning Home): If a worker was sent to do a task and is now coming back, WARPGUARD checks: "Did you actually finish the task you were sent to do? Is your return ticket valid?" If the ticket looks fake or the worker is trying to go home to the wrong house, WARPGUARD slams the gate shut immediately.
- Forward Edge (Going to a New Job): If a worker is being sent to a new machine, WARPGUARD checks the list: "Is this new machine on the approved list for this specific worker?" If the worker tries to go to a machine that isn't on their specific list, the gate shuts.
2. Why "SASS" Matters
The paper emphasizes that you can't just look at the human-readable code (the "recipe") to do this. By the time the GPU runs, the recipe has been translated into SASS, and the factory has made its own decisions about how to organize the work (like inlining functions or moving data around).
- The Analogy: Imagine trying to stop a thief by looking at the original blueprint of a building, but the thief is actually breaking in through a hidden door created during construction. WARPGUARD looks at the actual construction site (the SASS binary) to see exactly where the doors are and who is allowed to walk through them.
3. The "Fail-Closed" Rule
This is the most important safety feature.
- If WARPGUARD is unsure if a worker is allowed to leave, or if the paperwork looks suspicious, it does not guess. It assumes the worst and locks the gate.
- The system is designed to "fail closed." It would rather stop a legitimate worker (causing a temporary delay) than let a hijacked worker drive off to destroy the factory.
4. What They Actually Tested
The researchers didn't just build this; they tested it on 77 different real-world GPU programs (artifacts).
- They found over 51,000 specific "exit points" (places where workers decide where to go).
- They ran 52 million checks in real-time.
- The Result: When they tried to trick the system with fake addresses or corrupted return tickets:
- Without WARPGUARD: The workers went exactly where the hacker wanted.
- With WARPGUARD (Detection Mode): The system sounded an alarm and logged the attempt.
- With WARPGUARD (Enforcement Mode): The system caught the attempt and stopped the worker before they could leave the gate.
5. What It Doesn't Do (The Boundaries)
The paper is very clear about what WARPGUARD is not:
- It doesn't fix the memory bug itself (it doesn't stop the hacker from slipping the fake note in).
- It doesn't protect against every single possible attack, only the ones where the "exit door" logic can be clearly verified.
- If the system can't figure out where a worker is supposed to go (because the paperwork is too messy), it marks that area as "unsupported" and doesn't pretend to protect it. It's better to admit ignorance than to give a false sense of security.
Summary
WARPGUARD is like a super-strict bouncer at the exit of a high-speed GPU factory. It ignores the messy supply chain and focuses entirely on the moment a worker tries to leave. It checks their ID and their destination against a strict, verified list. If anything looks even slightly wrong, it locks the door. It is the first system to do this specifically for the raw, compiled code (SASS) that modern GPUs actually run, proving that even in a chaotic, high-speed environment, you can stop hackers from hijacking the control flow.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.