Mitigation of Virtunoid Attacks on Cloud Computing Systems
Total Page：16
File Type：pdf, Size：1020Kb
IT 15 005 Examensarbete 15 hp Februari 2015 Mitigation of Virtunoid Attacks on Cloud Computing Systems Daniel McKinnon Forsell Institutionen för informationsteknologi Department of Information Technology Abstract Mitigation of Virtunoid Attacks on Cloud Computing Systems Daniel McKinnon Forsell Teknisk- naturvetenskaplig fakultet UTH-enheten Virtunoid is a proof of concept exploit abusing a vulnerability in the open source hardware virtualisation control program QEMU-KVM. The vulnerability originally Besöksadress: stems from improper hotplugging of emulated embedded circuitry in the Intel PIIX4 Ångströmlaboratoriet Lägerhyddsvägen 1 southbridge resulting in memory corruption and dangling pointers. The exploit can be Hus 4, Plan 0 used to compromise the availability of the virtual machine, or to escalate privileges compromising the confidentiality of the resources in the host system. The research Postadress: presented in this dissertation shows that the discretionary access control system, Box 536 751 21 Uppsala provided by default in most Linux operating systems, is insufficient in protecting the QEMU-KVM hypervisor against the Virtunoid exploit. Further, the research presented Telefon: in this dissertation shows that the open source solutions AppArmor and grsecurity 018 – 471 30 03 enhances the Linux operating system with additional protection against the Virtunoid Telefax: exploit through mandatory access control, either through profiling or role-based 018 – 471 30 00 access control. The research also shows that the host intrusion prevention system PaX does not provide any additional protection against the Virtunoid exploit. The Hemsida: comprehensive and detailed hands-on approach of this dissertation holds the ability to http://www.teknat.uu.se/student be reproduced and quantified for comparison necessary for future research. Handledare: Edith C. H. Ngai Ämnesgranskare: Björn Victor Examinator: Olle Gällmo IT 15 005 Tryckt av: Reprocentralen ITC Abstract Virtunoid is a proof of concept exploit abusing a vulnerability in the open source hardware virtualisation control program QEMU-KVM. The vulnerability originally stems from improper hotplugging of emulated embedded circuitry in the Intel PIIX4 southbridge resulting in memory corruption and dangling point- ers. The exploit can be used to compromise the availability of the virtual ma- chine, or to escalate privileges compromising the confidentiality of the resources in the host system. The research presented in this dissertation shows that the discretionary access control system, provided by default in most Linux oper- ating systems, is insufficient in protecting the QEMU-KVM hypervisor against the Virtunoid exploit. Further, the research presented in this dissertation shows that the open source solutions AppArmor and grsecurity enhances the Linux op- erating system with additional protection against the Virtunoid exploit through mandatory access control, either through profiling or role-based access control. The research also shows that the host intrusion prevention system PaX does not provide any additional protection against the Virtunoid exploit. The com- prehensive and detailed hands-on approach of this dissertation holds the ability to be reproduced and quantified for comparison necessary for future research. Acknowledgements During 2014 I spent the summer and autumn at the Department of Information Technology at Uppsala University, Sweden, to conduct research and write my bachelor of science dissertation in computer science. Information technology and IT-security have long been a great passion for me personally, and I am very grateful to have been given the opportunity to perform my research as a member of the departments research community. I would like to extend my gratitude to Dr. Edith Ngai for her supervision of my work and her invaluable insights, guidance, and support. Further, I would also like to thank Dr. Björn Victor for his excellent support as my reviewer ensuring the quality of my work. Uppsala, February 2015 vii Contents 1 Introduction 1 1.1 The Realm of Virtualisation . 2 1.2 SecurityThreats ........................... 3 1.3 Problem Formulation . 4 1.4 Experiment Variables . 4 1.4.1 Dependent Variables . 5 1.4.2 IndependentVariables . 5 1.5 Research Question . 5 1.6 Research Project Outline . 5 1.7 Delimination of the Research Project . 5 1.8 Structure of the Dissertation . 6 2 Related Work 7 2.1 Security Aspects Related to Virtualisation . 7 2.2 Defining Virtualisation Security and Related Vulnerabilities . 9 2.3 Protecting KVM . 10 3 Technical Foundations 13 3.1 ThreeTypesofHypervisors . 13 3.2 The Family of Unix-like Operating Systems . 15 3.3 At the Inner Core of The Linux Operating System . 15 3.4 Linux Security Modules Framework to Affirm Choice . 16 3.5 TheKernel-basedVirtualMachine . 17 3.6 QEMU – Quick EMUlator . 17 3.7 QEMU-KVM Symbiosis . 18 3.8 Mandatory Access Control with AppArmor . 18 3.9 Role-based Access Control with grsecurity . 19 4 Introducing the Vulnerability and the Exploit 21 4.1 The CVE-2011-1751 Vulnerability . 21 4.2 Elaborating on The Exploit . 25 5 Executing Virtunoid in Different Settings 29 5.1 Preparing the Lab Environment . 29 5.2 TheLabHostSystem ........................ 30 5.3 Reconnaissance and Information Gathering . 34 5.4 Setting Up the Attack . 35 5.5 BackDoorAssuringContinuedAccess . 36 ix 5.6 SecuringtheSystemwithAppArmor . 38 5.7 Enabling the grsecurity Role-based Access Control System . 40 5.8 Hardening the System Using PaX . 42 6 Results 45 6.1 Results . 45 6.2 Testing the Attack Without Protection . 45 6.3 Mandatory Access Control using AppArmor . 47 6.4 Role-based Access Control using grsecurity . 48 6.5 Kernel Security Hardening using PaX . 49 6.6 SummaryandComparisonoftheMethods. 50 7 Discussion 53 7.1 TheMethod.............................. 53 7.2 Limitations to the Research . 54 7.3 AppArmor . 54 7.4 grsecurity/PaX . 55 8 Conclusions and Future Work 57 x List of Figures 1.1 Virtualisation-based cloud computing [30] . 2 3.1 Simplified type 1 hypervisor architecture [30] . 14 4.1 SimplifiedComputerArchitecture[4] . 22 4.2 Intel 82371AB (PIIX4) Southbridge Circuitry Architecture [15] . 23 4.3 The data structures in the real-time clock emulation layer . 24 4.4 RTCState freed after unplugging the ISA bridge . 25 4.5 Using QEMU-KVM network stack to inject data to old RTCState 26 5.1 Theexperimentsetup ........................ 30 5.2 Cryptographic hashes for QEMU-KVM binaries . 32 5.3 Linux Debian guest operating system . 34 5.4 CreatingarawTCPsocket . 37 5.5 AppArmor learning the behaviour of QEMU-KVM . 39 5.6 Creating the AppArmor profile for QEMU-KVM . 40 5.7 QEMU-KVM AppArmor profile . 41 5.8 Verifying that grsecurity RBAC is activated . 41 5.9 Saving the learning experience to a plain-text file . 41 5.10 Verifying the signature . 42 5.11 Configuringthekernel . 43 6.1 View from Kali Linux before and after the attack . 46 6.2 View from the guest system after the attack . 46 6.3 View from the host server system after the attack . 46 6.4 Cracking the cryptographic hash . 47 6.5 Theguestvirtualmachinecrashed . 48 6.6 AppArmor log entry . 48 6.7 Verifying that grsecurity RBAC is activated . 49 6.8 Output from Virtunoid . 49 6.9 Testing QEMU-KVM with all PaX flags activated . 50 xi List of Tables 5.1 Detailed software specification . 30 5.2 Detailed hardware specification Apple MacBook MB467LL/A . 31 5.3 Relevant binaries and respective cryptographic hashes . 33 6.1 Tabular comparison of the methods . 51 xiii Chapter 1 Introduction Cloud computing as a term is focused on the concept of hiding technical aspects through abstraction. The term is often used in business contexts where the need for technical depth might not be particularly high [6]. Cloud computing systems in the context of this dissertation project is defined as the high level technological concept implemented to make a transition from the traditional and physical server room into the cloud. The cloud, at a lower level, consist of abstract virtual server machines. These virtual machines are virtualised by so called virtual machine management software [6]. Replacing the traditional local server room with off site multi tenancy cloud computing systems is becoming increasingly popular [6]. This transition comes with serious risks and threats against the confidentiality and availability of information technology assets [41]. These issues must be addressed to sus- tain the stakeholders trust in these attractive systems. At the heart of most virtualisation-based cloud computing systems lies the hypervisor [1], i.e. the hardware virtualisation control program responsible for abstracting hardware to provide entire virtual computer systems. QEMU-KVM is a popular open- source hypervisor available for Linux-based operating systems [31]. Virtunoid is a proof of concept exploit abusing a vulnerability in the QEMU-KVM hy- pervisor that could be used for guest to host breakout and privilege escalation [27]. The research presented in this dissertation shows that the discretionary ac- cess control, provided by default in most Unix-like operating systems [1], is in- sufficient in protecting against a number of vulnerabilities related to the QEMU- KVM hypervisor and, as presented in this dissertation, against the Virtunoid exploit in particular. This research project tries to identify solutions that can be used to protect the QEMU-KVM hypervisor against so called guest to host arbitrary code execution made possible by so called dangling pointer bugs. Dan- gling pointer bugs are a