OS-LEVELATTACKSANDDEFENSES: FROMSOFTWARETOHARDWARE-BASEDEXPLOITS Dissertation zur Erlangung des akademischen Grades Doktor der Ingenieurswissenschaften (Dr.-Ing.) genehmigt durch den Fachbereich Informatik (FB 20) der Technischen Universtität Darmstadt von D AV I D G E N S aus Wiesbaden, Deutschland Gutachter: Prof. Dr.-Ing. Ahmad-Reza Sadeghi (Erstreferent) Prof. Dr. Thorsten Holz (Zweitreferent) Tag der Einreichung: 14. Dezember 2018 Tag der Disputation: 13. Februar 2019 CYSEC/System Security Lab Intel Collaborative Research Institute (ICRI-CARS) Fachbereich für Informatik Technische Universität Darmstadt Hochschulkennziffer: D17 OS-level Attacks and Defenses: from Software to Hardware-based Exploits © December 2018 by David Gens phd referees: Prof. Dr.-Ing. Ahmad-Reza Sadeghi (1st PhD Referee) Prof. Dr. Thorsten Holz (2nd PhD Referee) further phd commission members: Prof. Dr. Sebastian Faust Prof. Dr. Guido Salvaneschi Prof. Dr.-Ing. Thomas Schneider Darmstadt, Germany December 2018 Veröffentlichung unter CC-BY-SA 4.0 International https://creativecommons.org/licenses/ ABSTRACT Run-time attacks have plagued computer systems for more than three decades, with control-flow hijacking attacks such as return-oriented programming repre- senting the long-standing state-of-the-art in memory-corruption based exploits. These attacks exploit memory-corruption vulnerabilities in widely deployed soft- ware, e.g., through malicious inputs, to gain full control over the platform remotely at run time, and many defenses have been proposed and thoroughly studied in the past. Among those defenses, control-flow integrity emerged as a powerful and ef- fective protection against code-reuse attacks in practice. As a result, we now start to see attackers shifting their focus towards novel techniques through a number of increasingly sophisticated attacks that combine software and hardware vulnerabil- ities to construct successful exploits. These emerging attacks have a high impact on computer security, since they completely bypass existing defenses that assume ei- ther hardware or software adversaries. For instance, they leverage physical effects to provoke hardware faults or force the system into transient micro-architectural states. This enables adversaries to exploit hardware vulnerabilities from software without requiring physical presence or software bugs. In this dissertation, we explore the real-world threat of hardware and software- based run-time attacks against operating systems. While memory-corruption-based exploits have been studied for more than three decades, we show that data-only attacks can completely bypass state-of-the-art defenses such as Control-Flow In- tegrity which are also deployed in practice. Additionally, hardware vulnerabili- ties such as Rowhammer, CLKScrew, and Meltdown enable sophisticated adver- saries to exploit the system remotely at run time without requiring any memory- corruption vulnerabilities in the system’s software. We develop novel design strate- gies to defend the OS against hardware-based attacks such as Rowhammer and Meltdown to tackle the limitations of existing defenses. First, we present two novel data-only attacks that completely break current code-reuse defenses deployed in real-world software and propose a randomization-based defense against such data- only attacks in the kernel. Second, we introduce a compiler-based framework to automatically uncover memory-corruption vulnerabilities in real-world kernel code. Third, we demonstrate the threat of Rowhammer-based attacks in security- sensitive applications and how to enable a partitioning policy in the system’s phys- ical memory allocator to effectively and efficiently defend against such attacks. We demonstrate feasibility and real-world performance through our prototype for the popular and widely used Linux kernel. Finally, we develop a side-channel defense to eliminate Meltdown-style cache attacks by strictly isolating the address space of kernel and user memory. iii ZUSAMMENFASSUNG Softwarebasierte Laufzeitangriffe stellen Rechnerplattformen seit mehr als drei Jahrzehnten vor große Sicherheitsprobleme. In Form weit verbreiteter Offensivtech- niken wie Return-Oriented Programming, die Programmierfehler durch bösartige Eingaben gezielt ausnutzen, können Angreifer im Extremfall so die vollständige Kontrolle über die Plattform erlangen. Daher wurden über die Jahre eine Vielzahl von Defensivmaßnahmen wie Control-Flow Integrity und Fine-Grained Randomi- zation vorgeschlagen und die Effektivität dieser Schutzmechanismen war lange Zeit Gegenstand intensiver Forschungsarbeit. In jüngster Zeit wurden jedoch eine Reihe zunehmend ausgefeilterer Angriffe auf Hardwareschwachstellen aus Softwa- re heraus vorgestellt, die bei Beibehaltung des Angreifersmodells zur kompletten Kompromittierung dieser Systeme führen können. Diese neuartige Entwicklung stellt bestehende Verteidigungen, die traditionelle Softwareangriffe annehmen, so- mit in der Praxis vor große Herausforderungen. Diese Dissertation erforscht eine Reihe solcher neuartigen Angriffsszenarien, um die reale Bedrohung auf das Betriebssystem trotz bestehender Verteidigungsme- chanismen abschätzen zu können. Insbesondere geht die Arbeit im ersten Teil auf die Problematik sogenannter Data-Only Angriffe im Kontext von Defensivmaß- nahmen wie Control-Flow Integrity ein und demonstriert, wie diese unter Aus- nutzung von Softwarefehlern vollständig ausgehebelt werden können. Der zweite Teil erforscht die Bedrohung von Laufzeitangriffen durch Hardwarefehler, auch in Abwesenheit von Softwarefehlern auf welche sich bisherige Verteidigungen be- schränken. Um die bisherigen Problem in den vorhandenen Schutzmechanismen anzugehen wurden neue Designstrategien entwickelt, mit Hilfe derer sich das Be- triebssystem vor solch weiterführenden Angriffen durch geeignete Maßnahmen in Software schützen kann. Zunächst demonstrieren wir eine randomisierungs- basierte Verteidigung gegen Data-Only Angriffe auf Seitentabellen. Des weiteren wird ein Framework zur automatisierten Identifikation von Softwarefehlern im Betriebssystem anhand des Quelltexts auf Basis des LLVM Compilers vorgestellt. Außerdem erforscht die Arbeit eine Absicherung des Betriebbsystems vor Seitenka- nalangriffen durch geeignete Isolation des Addressraumes. Ferner entwickeln wir eine Schutzmaßnahme vor Rowhammer-basierten Angriffen auf das OS, indem der physische Speicherallokator des Systems um eine Partitionierungsstrategie er- weitert wird. v ACKNOWLEDGMENTS First and foremost I would like to thank my thesis advisor Professor Ahmad-Reza Sadeghi for his excellent supervision and continuous support. I am grateful to have Professor Thorsten Holz as thesis co-advisor. I thank Professor Sebastian Faust, Professor Guido Salvaneschi, and Professor Thomas Schneider for being members of my thesis committee. Additional thanks go to Professor Lucas Davi with whom I had the privilege to collaborate and work with while he was still based in Darmstadt and who offered me an initial position in his Junior Research Group funded by DFG’s Emmy Noether program. My research work and travels were funded in part by the Federal Ministry of Education and Research (BMBF) through SAL and by the DFG through CROSS- ING, both of which provided a great working environment and allowed me to collaborate with renowned and leading researchers from academia and industry worldwide. Further, I thank all my co-authors besides Ahmad and Lucas: Orlando Arias, Fer- dinand Brasser, Poulami Das, Ghada Dessouky, Lisa Eckey, Rolf Egert, Sebastian Faust, Marc Fischlin, Tommaso Frassetto, Jason M. Fung, Patrick Haney, Kristina Hostakova, Sven Jacob, Patrick Jauernig, Yier Jin, Arun Karthik Kanuparthi, Ha- reesh Khattri, Christopher Liebchen, Garrett Persyn, Jeyavijayan Rajendran, Si- mon Schmitt, Matthias Senker, Emmanuel Stapf, Dean Sullivan, Jörg Tillmans, and Shaza Zeitouni. Thanks to all my colleagues of the System Security Lab at Technische Universität Darmstadt for fruitful and interesting technical discussion, as well as their help in organizing courses, and a great time. Finally, I would like to thank my family and in particular my parents Monika and Andreas for their continuing encouragement. Special thanks to Miriam for her enduring sympathy, support, and friendship. vii CONTENTS I introduction 1 overview3 1.1 Goals and Scope 5 1.2 Summary of Contributions 5 1.3 Organization 7 1.4 Publications 8 2 background9 2.1 Basic OS-level Defenses 9 2.1.1 Privilege-Level Separation 9 2.1.2 Virtual-Memory Protection 10 2.2 The Traditional Threat Models 11 2.3 Memory-Corruption Attacks 12 2.3.1 Causes of Memory Corruption 12 2.3.2 A Model for Exploitation 13 2.3.3 Typical Attack Workflow 14 2.4 State-of-the-art Attacks and Defenses 15 2.4.1 Return-to-libc and Return-Oriented Programming 15 2.4.2 Code-Reuse Defenses and Advanced Attacks 16 2.4.3 Data-only attacks 17 2.5 Modern Hardware Platforms 18 2.5.1 Overall System Architecture 18 2.5.2 Processor Design Principles 19 2.5.3 Remote Hardware Exploits 21 II memory corruption: the threat of data-only attacks 3 bypassing cfi in modern browsers. 25 3.1 Data-Only Attacks on Dynamic Code Generation 25 3.2 Assumptions and Threat Model 26 3.3 Generically Bypassing CFI by Exploiting JIT-Compilers 27 3.3.1 Attack Overview 27 3.3.2 Corrupting the Intermediate Representation 28 3.3.3 Attack Framework 29 3.4 On the Prevalence of Data-Only Attacks 29 3.5 Possible Mitigations 30 4 breaking and fixing cfi in os kernels. 31 4.1 OS Kernels as Targets of Data-Only Attacks