  Data exfiltration attacks have led to huge data breaches. Recently, the
Equifax attack affected 147M users and a third-party library - Apache Struts -
was alleged to be responsible for it. These attacks often exploit the fact that
sensitive data are stored unencrypted in process memory and can be accessed by
any function executing within the same process, including untrusted third-party
library functions. This paper presents StackVault, a kernel-based system to
prevent sensitive stack-based data from being accessed in an unauthorized
manner by intra-process functions. Stack-based data includes data on stack as
well as data pointed to by pointer variables on stack. StackVault consists of
three components: (1) a set of programming APIs to allow users to specify which
data needs to be protected, (2) a kernel module which uses unforgeable function
identities to reliably carry out the sensitive data protection, and (3) an LLVM
compiler extension that enables transparent placement of stack protection
operations. The StackVault system automatically enforces stack protection
through spatial and temporal access monitoring and control over both sensitive
stack data and untrusted functions. We implemented StackVault and evaluated it
using a number of popular real-world applications, including gRPC. The results
show that StackVault is effective and efficient, incurring only up to 2.4%
runtime overhead.
