Exploiting Kernel Races Through Taming Thread Interleaving Yoochan - PowerPoint PPT Presentation

Exploiting Kernel Races Through Taming Thread Interleaving Yoochan Lee, Byoungyoung Lee, Chanwoo Min Seoul National University, Virginia Tech #BHUSA @BLACKHATEVENTS

Summary • New technique turning • Background on races • Classification on races unexploitable races to • Unexploitable races exploitable races #BHUSA @BLACKHATEVENTS

Race condition is an increasing attack vector 30 bugs 143 bugs 104 bugs 81 bugs 15 bugs 111 bugs 7 bugs 59 bugs 67 bugs UAF UAF UAF OOB OOB Race Race Uninit OOB # of fixed bugs that Syzkaller found in 2017 # of fixed bugs that Syzkaller found in 2018 # of fixed bugs that Syzkaller found in 2019 • Razzer, IEEE S&P 2019, found more than 30 race bugs . • KCSAN, developed by Google 2019, found more than 300 race bugs . #BHUSA @BLACKHATEVENTS 3

Background : Race condition Core 1 Core 2 current A Result can be a execution value stored in memory or B a value read by read instruction Pair of race instruction Access Order B A >> Result X è Instructions that A B access the same memory A B >> Result Y è • Accessing the same memory location from two processors è Execution results are different depending on the access order. #BHUSA @BLACKHATEVENTS 4

Background : Race Condition Vulnerability Race Condition Race Condition = + Memory Corruption Vulnerability Race instruction pair A Overflow Race instruction pair B Use-After-Free . . . . . . #BHUSA @BLACKHATEVENTS 5

Background : to trigger Race Condition Vulnerability if A B C , then memory corruption occurs. Brute forcing : Try until success #BHUSA @BLACKHATEVENTS 6

Background : Exploitability of Race Condition Vulnerability A very specific Availability of Exploitable = + memory access order Memory Corruption Races? B C , then) A >> >> (e.g., if #BHUSA @BLACKHATEVENTS 7

Classification of Race Condition Vulnerability Race Condition Vulnerability Single Variable Multi Variable Race Condition Race Condition Race instruction pair 1 for M1 Race instruction pair 1 for M1 Race instruction pair 2 for M1 Race instruction pair 2 for M2 Single variable Multi variable … … #BHUSA @BLACKHATEVENTS 8

Single-variable Race Condition do_ip_setsockopt() raw_sendmsg() { Core 1 Core 2 { … Pair A … inet->hdrincl is 1 if ( ! inet->hdrincl ) { A // initialize rfv variable B inet->hdrincl = 0; rfv.msg = msg; Time … B … Window } C } inet->hdrincl is 0 if ( ! inet->hdrincl ) { memcpy(to, rfv->hdr.c, … ); C } Pair … } Case study : CVE-2017-17712 Control Flow Dependency A B C , then uninitialized buffer use occurs. Data Flow Dependency if >> >> #BHUSA @BLACKHATEVENTS 9

Exploitability of Single-variable Race Core 1 Core 2 Order violation A Time B Window C Order violation • Brute-forcing would somehow trigger the race è if B can be executed within the time window • The smaller the time window is, the lower the probability of successful races. #BHUSA @BLACKHATEVENTS 10

Multi-variable Race Condition Core 1 Core 2 Pair of race instruction A Instructions that B A access the M1 B Time Time Window Window Pair of race instruction x y C Instructions that C D access the M2 D B C A D if >> && >> , Control flow Dependency then memory corruption occurs. Data flow Dependency #BHUSA @BLACKHATEVENTS 11

Multi-variable Race Condition Multi-variable Race Condition Core 1 Core 2 Core 1 Core 2 Inst pair to access M1 A Inst pair B to access M1 B A Ty Tx Tx Ty C D D C Inst pair Inst pair to access M2 to access M2 Tx > Ty Tx ≤ Ty Inclusive Multi-variable Race Non-inclusive Multi-variable Race #BHUSA @BLACKHATEVENTS 12

Exploitability of Inclusive Multi-variable Race Core 1 Core 2 Race Pair A B Ty Tx C D Race Pair • Brute-force somehow works. • The more similar the two time windows are, the lower the probability that a race will occur. #BHUSA @BLACKHATEVENTS 13

Problem : Exploitability of Non-inclusive Race Core 1 Core 2 binder_alloc_new_buf_locked() binder_alloc_mmap_handler() A { { // initialize vma B Tx B A if (alloc-> vma == NULL) return ERR; alloc-> vma = vma; D Tx = 18 cycles Ty = 2250 cycles D alloc-> vma_vm_mm = vma->vm_mm; Ty C mmget_not_zero(alloc-> vma_vm_mm )); Even if, A >> B is succeed, } C >> D will be failed } C Case study : Patch #987393 && C A B D C if >> >> , then uninitialized buffer use occurs in . • Brute-force never works. • impossible to execute with the order of . && C A B D >> >> #BHUSA @BLACKHATEVENTS 14

Problem : Exploitability of Non-inclusive Race Core 1 Core 2 Tx Ty 35 450 A CVE-2017-15265 150 1,800 CVE-2019-1999 B Tx 50 600 CVE-2019-2025 D 18 1,210 CVE-2019-6974 Non-inclusive race vulnerabilities 1,153 13,121 #1035566 Ty Even if, found in linux kernel 18 2,250 #987393 A >> B is succeed, 120 730 #759959 C >> D will be failed C . . . • Brute-force never works. • impossible to execute with the order of . && C A B D >> >> #BHUSA @BLACKHATEVENTS 15

Previous method : Using Different Core Latency Execution Order : C D A >> B & >> race_function1(): D A Core 1 1.6 Ghz race_function2(): C B Core 2 2.5 Ghz • e.g., Qualcomm Snapdragon 845 4x 2.5GHz, 4x 1.6GHz #BHUSA @BLACKHATEVENTS 16

Previous method : Using Different Core Latency Execution Order : C D A >> B & >> race_function1(): D A Core 1 1.6 Ghz function2(): C B Core 2 2.5 Ghz • e.g., Qualcomm Snapdragon 845 4x 2.5GHz, 4x 1.6GHz #BHUSA @BLACKHATEVENTS 17

Limitations of Use Different Core Latency • Must use the CPU that latency between the cores are different. CPU • Not applicable to vulnerabilities with large time window differences CPU dependency #BHUSA @BLACKHATEVENTS 18

Previous Approach : Using scheduler (CONFIG_PREEMPT) Execution Order : C D A >> B & >> Core 0 Jann Horn, Linux Security Summit EU 2019, "Exploiting Race Conditions Using the Scheduler” Core 1 è sched_setaffinity() Core 2 current Wait queue : execution #BHUSA @BLACKHATEVENTS 19

Previous Approach : Using scheduler (CONFIG_PREEMPT) Execution Order : A sched_setaffinity(Core 1, self): R Core 0 Hey, you need to reschedule race_function1(): D A Core 1 race_function2(): C B Core 2 current Wait queue : execution #BHUSA @BLACKHATEVENTS 20

Previous Approach : Using scheduler (CONFIG_PREEMPT) Execution Order : C A >> B & Core 0 sched_setaffinity(Core 1, self): R Core 1 function2(): C B Core 2 race_function1(): current Wait queue : D execution #BHUSA @BLACKHATEVENTS 21

Previous Approach : Using scheduler (CONFIG_PREEMPT) Execution Order : C D A >> B & >> Core 0 race_function1(): D A Core 1 Core 2 current Wait queue : execution #BHUSA @BLACKHATEVENTS 22

Limitation of Using scheduler • Can be used when COFIG_PREEMPT option is applied. • Linux uses CONFIG_PREEMPT_VOLUTARY option by default. Configuration dependency #BHUSA @BLACKHATEVENTS 23

Each of methods has obvious limitations CPU CPU dependency Configuration dependency • All previous methods are hard to be used in general. • We need a new method that extends the time window. #BHUSA @BLACKHATEVENTS 24

How to extend the time window? A D Core 1 Core 1 1. Stop the core 2. Degrade the performance #BHUSA @BLACKHATEVENTS 25

Slow Fast ExpRace Performance : A Interrupt handler! Interrupt handler! Interrupt handler! D Core 1 Bullets • Inter-processor interrupt • Hardware Interrupt Attacker • The key idea of ExpRace is to keep raising interrupts to indirectly alter kernel thread’s interleaving. #BHUSA @BLACKHATEVENTS 26

ExpRace : How to send IPI & IRQ with user priv user_function() syscall() Send IPI { { syscall(); send_IPI(); to core1 } } Attacker Core 1 User mode Kernel mode (User Priv) user_function() syscall() Request Send IRQ { { syscall(); send_REQ(); to device to core1 } } Hardware device Attacker Core 1 User mode Kernel mode (User Priv) #BHUSA @BLACKHATEVENTS 27

ExpRace : TLB Shootdown ~ ~ ~ ~ ~ ~ 0xABC0 0xABD0 0xABE0 0xABC0 0xABD0 0xABE0 IPI cache Flush 0xABD0 cache ? IPI_handler() munmap(0xABD0) Core 1 Core 2 • Modern OSs implement a TLB shootdown mechanism to ensure that TLB entries are synchronized across different cores. • Syscalls that either modify the permission of the page (e.g., mprotect()) or unmap (e.g., munmap()) the page use IPI for TLB shootdown. #BHUSA @BLACKHATEVENTS 28

ExpRace : IPI Environment setting mm α mm β mm α Process C Process A Process B Process C Process A Process B (Core 0) (Core 1) (Core 2) (Core 0) (Core 1) (Core 2) A A B B IPI_send IPI_send (core 1) (core 1 and core 2) Interrupt Interrupt α α handler Tx + α handler Interrupt Ty + α α Tx + α Ty handler D C C D If 3 processes have same mm If process A and C have same mm, and B have different mm #BHUSA @BLACKHATEVENTS 29