Introduction RˆX Fine-grained KASLR Evaluation kR^X Comprehensive Kernel Protection against Just-In-Time Code Reuse Marios Pomonis 1 Theofilos Petsios 1 Angelos D. Keromytis 1 Michalis Polychronakis 2 Vasileios P. Kemerlis 3 1 Columbia University 2 Stony Brook University 3 Brown University mpomonis@cs.columbia.edu kR^X 1 / 30
Introduction RˆX Fine-grained KASLR Evaluation $ > whoami ◮ Ph.D. candidate @Columbia University ◮ Member of the Network Security Lab • http://nsl.cs.columbia.edu ◮ Research interests • Kernel security • Data-flow tracking • http://www.cs.columbia.edu/~mpomonis mpomonis@cs.columbia.edu kR^X 2 / 30
Introduction RˆX Fine-grained KASLR Evaluation $ > whoami ◮ Ph.D. candidate @Columbia University ◮ Member of the Network Security Lab • http://nsl.cs.columbia.edu ◮ Research interests • Kernel security • Data-flow tracking • http://www.cs.columbia.edu/~mpomonis mpomonis@cs.columbia.edu kR^X 2 / 30
Introduction RˆX Fine-grained KASLR Evaluation Kernel Vulnerabilties (all vendors) 700 600 500 # of vulnerabilities 400 300 200 100 0 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 Source: National Vulnerability Database ( http://nvd.nist.gov ) mpomonis@cs.columbia.edu kR^X 3 / 30
Introduction RˆX Fine-grained KASLR Evaluation Linux Kernel Vulnerabilties 350 300 250 # of vulnerabilities 200 150 100 50 0 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 Source: CVE Details ( http://www.cvedetails.com ) mpomonis@cs.columbia.edu kR^X 4 / 30
Introduction RˆX Fine-grained KASLR Evaluation Kernel Exploitation 101 ◮ Userland Exploitation • Code Injection • Code Reuse mpomonis@cs.columbia.edu kR^X 5 / 30
Introduction RˆX Fine-grained KASLR Evaluation Kernel Exploitation 101 ◮ Userland Exploitation • Code Injection [ W^X ] • Code Reuse [ ASLR ] mpomonis@cs.columbia.edu kR^X 5 / 30
Introduction RˆX Fine-grained KASLR Evaluation Kernel Exploitation 101 ◮ Userland Exploitation • Code Injection [ W^X ] • Code Reuse [ ASLR ] ◮ Kernel Exploitation mpomonis@cs.columbia.edu kR^X 5 / 30
Introduction RˆX Fine-grained KASLR Evaluation Kernel Exploitation 101 ◮ Userland Exploitation • Code Injection [ W^X ] • Code Reuse [ ASLR ] ◮ Kernel Exploitation • ret2usr mpomonis@cs.columbia.edu kR^X 5 / 30
Introduction RˆX Fine-grained KASLR Evaluation Kernel Exploitation 101 ◮ Userland Exploitation • Code Injection [ W^X ] • Code Reuse [ ASLR ] ◮ Kernel Exploitation • ret2usr [ SMEP , SMAP , . . . ] mpomonis@cs.columbia.edu kR^X 5 / 30
Introduction RˆX Fine-grained KASLR Evaluation Kernel Exploitation 101 ◮ Userland Exploitation • Code Injection [ W^X ] • Code Reuse [ ASLR ] ◮ Kernel Exploitation • ret2usr [ SMEP , SMAP , . . . ] • Code Injection • Code Reuse mpomonis@cs.columbia.edu kR^X 5 / 30
Introduction RˆX Fine-grained KASLR Evaluation Kernel Exploitation 101 ◮ Userland Exploitation • Code Injection [ W^X ] • Code Reuse [ ASLR ] ◮ Kernel Exploitation • ret2usr [ SMEP , SMAP , . . . ] • Code Injection [ W^X ] • Code Reuse [ KASLR ] mpomonis@cs.columbia.edu kR^X 5 / 30
Introduction RˆX Fine-grained KASLR Evaluation Kernel Exploitation 101 ◮ Userland Exploitation • Code Injection [ W^X ] • Code Reuse [ ASLR ] ◮ Kernel Exploitation • ret2usr [ SMEP , SMAP , . . . ] • Code Injection [ W^X ] • Code Reuse [ KASLR ] Hund et al. [Oakland ’13] Jang et al. [CCS ’16] Gruss et al. [CCS ’16] mpomonis@cs.columbia.edu kR^X 5 / 30
Introduction RˆX Fine-grained KASLR Evaluation Code Reuse Attacks Code push %rbx ◮ “Offline” Code Reuse mov $0x5,%rbx code pointer xor %rbx,%rax pop %rbx ret mov $0x1,%rdi call *%r8 jmp 0x4003e0 cmp %rsi,%rdx jae 0x4000100 add $0x500,%rdi jmp *%rdi test %rax,%rax jb 0x400043e xor %rcx,%rcx pop %r14 ret … Data mpomonis@cs.columbia.edu kR^X 6 / 30
Introduction RˆX Fine-grained KASLR Evaluation Code Reuse Attacks Code push %rbx ◮ “Offline” Code Reuse mov $0x5,%rbx code pointer xor %rbx,%rax pop %rbx • Code snippets ( gadgets ) ret mov $0x1,%rdi Ending with an indirect branch call *%r8 jmp 0x4003e0 • Stitch gadgets together cmp %rsi,%rdx jae 0x4000100 Perform arbitrary computations add $0x500,%rdi jmp *%rdi test %rax,%rax jb 0x400043e xor %rcx,%rcx pop %r14 ret … Data mpomonis@cs.columbia.edu kR^X 6 / 30
Introduction RˆX Fine-grained KASLR Evaluation Code Reuse Attacks Code mov $0x1,%rdi ◮ “Offline” Code Reuse [Code Diversification] call *%r8 code pointer jmp 0x4003e0 test %rax,%rax • Code snippets ( gadgets ) jb 0x400043e xor %rcx,%rcx Ending with an indirect branch pop %r14 ret • Stitch gadgets together cmp %rsi,%rdx jae 0x4000100 Perform arbitrary computations add $0x500,%rdi jmp *%rdi push %rbx mov $0x5,%rbx xor %rbx,%rax pop %rbx ret … Data mpomonis@cs.columbia.edu kR^X 6 / 30
Introduction RˆX Fine-grained KASLR Evaluation Code Reuse Attacks Code mov $0x1,%rdi ◮ “Offline” Code Reuse [Code Diversification] call *%r8 code pointer jmp 0x4003e0 test %rax,%rax • Code snippets ( gadgets ) jb 0x400043e memory xor %rcx,%rcx Ending with an indirect branch disclosure pop %r14 ret • Stitch gadgets together cmp %rsi,%rdx jae 0x4000100 Perform arbitrary computations add $0x500,%rdi jmp *%rdi ◮ “Just-In-Time” Code Reuse push %rbx mov $0x5,%rbx xor %rbx,%rax • Direct pop %rbx ret Read the (diversified) code … Construct the exploit on-the-fly Data mpomonis@cs.columbia.edu kR^X 6 / 30
Introduction RˆX Fine-grained KASLR Evaluation Code Reuse Attacks Code mov $0x1,%rdi ◮ “Offline” Code Reuse [Code Diversification] call *%r8 jmp 0x4003e0 test %rax,%rax • Code snippets ( gadgets ) jb 0x400043e memory xor %rcx,%rcx Ending with an indirect branch disclosure pop %r14 ret • Stitch gadgets together cmp %rsi,%rdx jae 0x4000100 Perform arbitrary computations add $0x500,%rdi jmp *%rdi ◮ “Just-In-Time” Code Reuse push %rbx mov $0x5,%rbx code pointer xor %rbx,%rax • Direct pop %rbx ret Read the (diversified) code … Construct the exploit on-the-fly Data mpomonis@cs.columbia.edu kR^X 6 / 30
Introduction RˆX Fine-grained KASLR Evaluation Code Reuse Attacks Code mov $0x1,%rdi ◮ “Offline” Code Reuse [Code Diversification] call *%r8 jmp 0x4003e0 test %rax,%rax • Code snippets ( gadgets ) jb 0x400043e memory xor %rcx,%rcx Ending with an indirect branch disclosure pop %r14 ret • Stitch gadgets together cmp %rsi,%rdx jae 0x4000100 Perform arbitrary computations add $0x500,%rdi jmp *%rdi ◮ “Just-In-Time” Code Reuse push %rbx mov $0x5,%rbx xor %rbx,%rax • Direct pop %rbx ret Read the (diversified) code … Construct the exploit on-the-fly Data • Indirect code pointer Read code pointers from the data code pointer Infer the randomized code layout code pointer mpomonis@cs.columbia.edu kR^X 6 / 30
Introduction RˆX Fine-grained KASLR Evaluation kRˆX ◮ Comprehensive kernel protection against code reuse attacks ✗ “Offline” Code Reuse ✗ JIT Code Reuse (direct/indirect) • No privileged entity (e.g., hypervisor) • Low overhead mpomonis@cs.columbia.edu kR^X 7 / 30
Introduction RˆX Fine-grained KASLR Evaluation kRˆX ◮ Comprehensive kernel protection against code reuse attacks ✗ “Offline” Code Reuse ✗ JIT Code Reuse (direct/indirect) • No privileged entity (e.g., hypervisor) • Low overhead RˆX: ◮ Execute-only Memory • Separate code and data regions New kernel memory layout • Mem. read → range check (RC) SFI-inspired ✓ Data region ✗ Code region mpomonis@cs.columbia.edu kR^X 7 / 30
Introduction RˆX Fine-grained KASLR Evaluation kRˆX ◮ Comprehensive kernel protection against code reuse attacks ✗ “Offline” Code Reuse ✗ JIT Code Reuse (direct/indirect) • No privileged entity (e.g., hypervisor) • Low overhead Fine-grained KASLR: RˆX: ◮ Execute-only Memory ◮ Randomized Code Layout • Separate code and data regions ✓ No gadgets at known location ✓ High entropy → no guessing New kernel memory layout • Mem. read → range check (RC) ◮ Return address protection SFI-inspired • Encryption ( XOR -based) ✓ Data region ✗ Code region • Deception (Decoys) mpomonis@cs.columbia.edu kR^X 7 / 30
Introduction RˆX Fine-grained KASLR Evaluation RˆX: Memory Layout fi xmap area module1 .data module1 .text Modules module2 .data module2 .text kernel .brk kernel .bss Kernel Image kernel .data kernel .rodata kernel .text vmemmap space vmalloc arena Upper physmap Canonical Half mpomonis@cs.columbia.edu kR^X 8 / 30
Introduction RˆX Fine-grained KASLR Evaluation RˆX: Memory Layout fi xmap area module1 .data module1 .text Modules module2 .data ✗ Multiple code sections → multiple RCs module2 .text • High overhead kernel .brk ◮ Interleaved code and data kernel .bss Kernel Image kernel .data kernel .rodata kernel .text vmemmap space vmalloc arena Upper physmap Canonical Half mpomonis@cs.columbia.edu kR^X 8 / 30
Recommend
More recommend
