A Non-Inclusive Memory Permissions Architecture for Protection - PowerPoint PPT Presentation

A Non-Inclusive Memory Permissions Architecture for Protection Against Cross-Layer Attacks Jesse Elwell 1 Ryan Riley 2 Nael Abu-Ghazaleh 1 Dmitry Ponomarev 1 1 State University of New York at Binghamton Department of Computer Science 2 Qatar University Department of Computer Science 20th International Symposium on High Performance Computer Architecture February 17th, 2014

Introduction & Motivation System software (Hypervisor/OS) is steadily increasing in complexity Complexity leads to vulberabilities Software Lines of Code Vulnerabilities KVM 30K 38 Xen 200K 59 Linux kernel 15M 228 A single vulnerability in system software can allow an attacker to compromise the entire system Binghamton University / Qatar University HPCA 2014 2 / 25

Example 1: Malicious Supervisor Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout OS User Binghamton University / Qatar University HPCA 2014 3 / 25

Example 1: Malicious Supervisor Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout OS User Sensitive READ-WRITE NO USER/SUPERVISOR Data Binghamton University / Qatar University HPCA 2014 3 / 25

Example 1: Malicious Supervisor Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout Buffer OS User Sensitive READ-WRITE NO USER/SUPERVISOR Data Binghamton University / Qatar University HPCA 2014 3 / 25

Example 1: Malicious Supervisor Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout Buffer Copy Sensitive READ-WRITE NO USER/SUPERVISOR Data Binghamton University / Qatar University HPCA 2014 3 / 25

Example 1: Malicious Supervisor Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout Sensitive Data OS User Sensitive READ-WRITE NO USER/SUPERVISOR Data Binghamton University / Qatar University HPCA 2014 3 / 25

Example 1: Malicious Supervisor Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout Sensitive Data OS User Sensitive READ-WRITE NO USER/SUPERVISOR Data Binghamton University / Qatar University HPCA 2014 3 / 25

Example 2: return-2-user Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout OS User Binghamton University / Qatar University HPCA 2014 4 / 25

Example 2: return-2-user Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout OS User Malicious READ-WRITE YES USER/SUPERVISOR Code Binghamton University / Qatar University HPCA 2014 4 / 25

Example 2: return-2-user Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout Code System Call OS User Malicious READ-WRITE YES USER/SUPERVISOR Code Binghamton University / Qatar University HPCA 2014 4 / 25

Example 2: return-2-user Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout Vulnerability Code Exploited OS User Malicious READ-WRITE YES USER/SUPERVISOR Code Binghamton University / Qatar University HPCA 2014 4 / 25

Example 2: return-2-user Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout Code OS Privileges OS User Malicious READ-WRITE YES USER/SUPERVISOR Code Binghamton University / Qatar University HPCA 2014 4 / 25

Example 2: return-2-user Attack x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Memory Layout Code OS Privileges OS User Malicious READ-WRITE YES USER/SUPERVISOR Code Binghamton University / Qatar University HPCA 2014 4 / 25

Cross-Layer Attack Flows App App App Guest OS Guest OS Hypervisor Binghamton University / Qatar University HPCA 2014 5 / 25

Cross-Layer Attack Flows App App App ret-2-user Guest OS Guest OS Hypervisor Binghamton University / Qatar University HPCA 2014 5 / 25

Cross-Layer Attack Flows App App App ret-2-user Guest OS Guest OS ret-2-VM Hypervisor Binghamton University / Qatar University HPCA 2014 5 / 25

Cross-Layer Attack Flows App App App ret-2-user Guest OS Guest OS ret-2-VM Hypervisor Binghamton University / Qatar University HPCA 2014 5 / 25

Cross-Layer Attack Flows App App App ret-2-user Guest OS Guest OS ret-2-VM Hypervisor Binghamton University / Qatar University HPCA 2014 5 / 25

Cross-Layer Attack Flows App App App ret-2-user Guest OS Guest OS ret-2-VM Hypervisor Binghamton University / Qatar University HPCA 2014 5 / 25

Non-Inclusive Memory Permissions Current Inclusive x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Binghamton University / Qatar University HPCA 2014 6 / 25

Non-Inclusive Memory Permissions Current Inclusive x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Binghamton University / Qatar University HPCA 2014 6 / 25

Non-Inclusive Memory Permissions Current Inclusive x86-64 Memory Permissions EXECUTABLE SUPERVISOR OR READ-ONLY OR YES/NO USER/SUPERVISOR READ-WRITE Non-Inclusive Memory Permissions (NIMP) Hypervisor Operating System User-Level Read Write Execute Read Write Execute Read Write Execute Binghamton University / Qatar University HPCA 2014 6 / 25

Mitigating Malicious Supervisor Attacks Non-Inclusive Memory Permissions Operating System User-Level Memory Layout Read Write Execute Read Write Execute Buffer Copy Sensitive NO NO NO YES YES NO Data Binghamton University / Qatar University HPCA 2014 7 / 25

Mitigating Malicious Supervisor Attacks Non-Inclusive Memory Permissions Operating System User-Level Memory Layout Read Write Execute Read Write Execute Buffer OS EXCEPTION! User Sensitive NO NO NO YES YES NO Data Binghamton University / Qatar University HPCA 2014 7 / 25

Mitigating Malicious Supervisor Attacks Non-Inclusive Memory Permissions Operating System User-Level Memory Layout Read Write Execute Read Write Execute Buffer OS EXCEPTION! User Sensitive NO NO NO YES YES NO Data Binghamton University / Qatar University HPCA 2014 7 / 25

Mitigating return-2-user Attacks Non-Inclusive Memory Permissions Operating System User-Level Memory Layout Read Write Execute Read Write Execute Code OS Privileges OS User Malicious NO NO NO YES YES YES Code Binghamton University / Qatar University HPCA 2014 8 / 25

Mitigating return-2-user Attacks Non-Inclusive Memory Permissions Operating System User-Level Memory Layout Read Write Execute Read Write Execute Code OS EXCEPTION! User Malicious NO NO NO YES YES YES Code Binghamton University / Qatar University HPCA 2014 8 / 25

Mitigating return-2-user Attacks Non-Inclusive Memory Permissions Operating System User-Level Memory Layout Read Write Execute Read Write Execute Code OS EXCEPTION! User Malicious NO NO NO YES YES YES Code Binghamton University / Qatar University HPCA 2014 8 / 25

NIMP Design Overview Permission Store Binghamton University / Qatar University HPCA 2014 9 / 25

NIMP Design Overview Memory Permission Change Requests Memory Permission Permission Store Manager Binghamton University / Qatar University HPCA 2014 9 / 25

NIMP Design Overview Memory Access Memory Permission Requests Change Requests Memory Permission Permission Permission Reference Store Manager Monitor Memory Access Decision Binghamton University / Qatar University HPCA 2014 9 / 25

The Permission Store 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Hypervisor OS User P Reserved S T R W X R W X R W X Binghamton University / Qatar University HPCA 2014 10 / 25

The Permission Store (Protected Memory) PS Entry 0 Permission Store 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 PS Entry 1 Hypervisor OS User P Reserved S PS Entry 2 T R W X R W X R W X . . . PS Entry N Physical Memory Binghamton University / Qatar University HPCA 2014 10 / 25

The Permission Store (Protected Memory) PS Entry 0 Permission Store 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 PS Entry 1 Hypervisor OS User P Reserved S PS Entry 2 T R W X R W X R W X . . . PS Entry N PS_BASE Register Physical Memory Binghamton University / Qatar University HPCA 2014 10 / 25

Augmenting TLBs to Store PS Entries TLB Virtual Physical Virtual Address Address Permissions 0x12345000 0x09ABC000 NX U RO . . . . . . . . . Binghamton University / Qatar University HPCA 2014 11 / 25