kGuard: Lightweight Kernel Protection against Return-to-User Attacks Authors: Vasileios P. Kemerlis Georgios Portokalidis Angelos D. Keromytis Presenter: Behnaz Hassanshahi

Problem Statement Kernel exploitation Kernel-level memory corruption Traditionally: Code injection – (Code Reuse)ROP Recently: Run user land code (ret2user attacks)

Return to User Attacks The root problem stems from the weak separation of user and kernel spaces. – Shared process/kernel model for Performance benefits – Kernel code can do anything in user land, so if it is abused, attacker can force it to run the shell code in user space. – Over-writing kernel-level control data(e.g., return addresses, jump tables, function pointers) with user space addresses.

Return to User Attacks Example: exploiting a NULL pointer dereference error to launch a ret2user attack Vulnerable program

Return to User Attacks 1.malicious process invokes “sendfile” system call with offending arguments 2.libc wrapper traps to the OS via “sysenter” 3.system call handler of Linux (sysenter_do_call()) is executed which resolves the kernel address of sys-sendfile 4.Privileged execution continues until sock_sendpage() is invoked 5.the value of sendpage pointer is NULL 6.control is transferred to address 0 7.malicious process has mmapped page 0 and dropped a function pointer of his own at address 0, the kernel will call that function pointer in kernel mode

Existing Defense Mechanisms CFI and Program Shepherding PAX Mmap_min_addr Intel SMEP – Doesn`t prevent kernel from accessing user “data”

kGuard Inline monitoring and code diversification – Adding “Control Flow Assertions” at compile time before every indirect control transfer E.g., call, jmp and ret in x86 CFA R : compares the branch target with lower kernel address 0xC00000 CFA m : – Branch target is within the kernel address space – Memory address where the branch target is loaded from is also in kernel space

kGuard Example CFA guard

Bypassing kGuard Bypass trampolines 1. Find two computed branch instructions whose operands can be reliably overwritten 2. Overwrite the value (branch target) of the first with the address of the second 3. Overwrite the value of the second with a user-space address 4. Solution: Code inflation and CFA motion

Code Inflation Reshapes the Kernel text at at compile time

CFA Motion Relocation of protected branches at boot time

Implementation The implementation consists of a plugin for GCC. At RTL level, after most of the important optimizations

Effectiveness on Privilege Escalation Attacks

Performance Evaluation

Performance Evaluation – latency overhead and code diversification

Conclusion and Discussion In near future all memory regions will be randomized Randomization of the address at which kernel is loaded Intel SMEP vs kGuard – Performance – Side channel attacks