Secure Virtual Architecture: Security for Commodity Software Systems
Total Page：16
File Type：pdf, Size：1020Kb
c 2014 by John T Criswell. All rights reserved. SECURE VIRTUAL ARCHITECTURE: SECURITY FOR COMMODITY SOFTWARE SYSTEMS BY JOHN T CRISWELL DISSERTATION Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science in the Graduate College of the University of Illinois at Urbana-Champaign, 2014 Urbana, Illinois Doctoral Committee: Professor Vikram Adve, Chair and Director of Research Associate Professor Madhusudan Parthasarathy Associate Professor Sam King Professor Greg Morrisett, Harvard University Abstract Commodity operating systems are entrusted with providing security to the applications we use everyday, and yet they suffer from the same security vulnerabilities as user-space applications: they are susceptible to memory safety attacks such as buffer overflows, and they can be tricked into dynamically loading malicious code. Worse yet, commodity operating system kernels are highly privileged; exploitation of the kernel results in compromise of all applications on the system. This work describes the Secure Virtual Architecture (SVA): a compiler-based virtual machine placed be- tween the software stack and the hardware that can enforce strong security policies on commodity application and operating system kernel code. This work describes how SVA abstracts hardware/software interactions and program state manipulation so that compiler instrumentation can be used to control these operations, and it shows how SVA can be used to protect both the operating system kernel and applications from attack. Specifically, this work shows how SVA can protect operating system kernels from memory safety attacks; it also shows how SVA prevents a compromised operating system kernel from adversely affecting the execution of trusted applications by providing application memory that the operating system kernel cannot read and write and secure application control flow that the operating system cannot corrupt. ii Acknowledgements I have so many people to thank that I’m likely to have forgotten someone. If I’ve forgotten you, please accept my apologies in advance. First, I thank Rosa Rosas for encouraging me to finish my undergraduate degree and for all of her patience and support while I worked on this dissertation. Hopefully the many nights I spent working on my dissertation gave you time to work on your dissertation. I thank my parents for nurturing my intellectual pursuits, for allowing me to spend late nights working on homework, and for their financial assistance in attending the University of Illinois. It looks like all that undergraduate tuition money was well spent. I thank my old friend, Forest Godfrey, for kindling my love of computing. My whole career in computing is pretty much his fault. I also thank the rest of the Godfrey family, Eric, Ann Marie, and Brighten, for their friendship and for being my role models. Ithankmyteachersforprovidingthefoundationuponwhichmygraduateeducationisbuilt.WhileI owe them all, I extend special thanks to Marsha Woodberry, Christine Stewart, James Watson, Mike Troyer, and Joe Barcio of the Ripon School District and the late Michael Faiman of the University of Illinois. IthankmycolleaguesatArgusSystemsGroupforkindlingmyloveofcomputersecurity.Iextendspecial thanks to Randy Sandone and Paul McNabb for giving me my first real job, Jason Alt and Mikel Matthews for their support, and JeffThompson for teaching me to always think critically. Ithankmyadvisor,VikramAdve,formotivatingmetoalwaysdobetterandforgettingmetoaccomplish more than I ever thought possible. I also thank him for his confidence and mentorship over the years. The greatest obstacle I faced was having confidence in myself, and you’ve helped me overcome that. Thank you. IthankmycommitteemembersMadhusudanParthasarathy,SamKing,andGregMorrisettfortheir interest in and feedback on my research work. Their suggestions have made this work better. Ithankmycollaboratorsandco-authors,includingNathanDautenhahn,NicolasGeoffray,DinakarDhur- jati, Brent Monroe, Andrew Lenharth, and Swarup Sahoo. I also thank my fellow graduate students Will iii Dietz, Arushi Aggarwal, and Rob Bocchino. I thank Pierre Salverda, David Raila, and Roy Campbell for numerous insightful discussions about the design of SVA-OS. Ithankallofourshepherdsandanonymousreviewersfortheirextensiveandhelpfulfeedbackonmy papers which contributed to this dissertation. I thank the LLVM community for providing a great compiler infrastructure with which to work. In particular, I thank Chris Lattner for his drive and hard work which made LLVM possible. I also thank Bin Zeng, Gang Tan, and Greg Morrisett for sharing their x86 CFI instrumentation pass with me. I also thank the FreeBSD community for providing a commodity operating system that compiles with LLVM/Clang. Finally, I thank Phil Wall for all the good times we had playing board games and drinking fine beer. Phil, you were more important to us than you ever knew. Rest in peace, kindred spirit and friend. iv Dedicated to Rosa Rosas. v Table of Contents ListofTables .............................................. xi ListofFigures.............................................. xii Chapter1 Introduction ....................................... 1 1.1 Motivation . 1 1.2 Secure Virtual Architecture . 2 1.3 EnforcingSecurityPolicieswithSVA. 3 1.4 Contributions............................................. 4 1.5 Organization . 5 Chapter 2 Virtual Architecture Support for Operating System Kernels . 6 2.1 Introduction.............................................. 6 2.2 Background: VISCArchitecturesandLLVA . 8 2.3 DesignoftheOSInterface...................................... 9 2.3.1 DesignGoalsfortheOSInterface . 9 2.3.2 StructureoftheInterface .................................. 10 2.3.3 Virtual and Native System State . 10 2.3.4 Manipulating Virtual and Native State . 11 2.3.5 InterruptsandTraps..................................... 12 2.3.6 SystemCalls ......................................... 13 2.3.7 Recovery from Hardware Faults . 14 2.3.8 VirtualMemoryandI/O .................................. 16 2.4 PrototypeImplementation...................................... 16 2.5 Preliminary Performance Evaluation . 17 2.5.1 Sources of Overhead . 18 2.5.2 Nanobenchmarks . 18 2.5.3 Microbenchmarks . 20 2.5.4 Macrobenchmarks . 21 2.6 Related Work . 21 Chapter3 SecureVirtualArchitecture. 24 3.1 Introduction.............................................. 24 3.2 Overview of the SVA Approach . 25 3.3 TheSVAExecutionStrategy .................................... 27 3.3.1 InstructionSetCharacteristics . 27 3.3.2 TheSVABootandExecutionStrategy . 27 3.4 Implementations ........................................... 28 3.5 Summary . 29 vi Chapter 4 Memory Safety for a Commodity Operating System Kernel . 30 4.1 Introduction.............................................. 30 4.2 Overview of SVA-M . 31 4.3 EnforcingSafetyforKernelCode . 32 4.3.1 Background: How SAFECode Enforces Safety for C Programs . 32 4.3.2 SAFECodeforaKernel:Challenges . 35 4.3.3 Integrating Safety Checking with Kernel Allocators . 36 4.3.4 KernelAllocatorChanges . 39 4.3.5 Run-time Checks . 40 4.3.6 Multiple Entry Points . 41 4.3.7 Manufactured Addresses . 42 4.3.8 AnalysisImprovements ................................... 43 4.3.9 Summary of Safety Guarantees . 44 4.4 MinimizingtheTrustedComputingBase. 46 4.5 Porting Linux to SVA . 47 4.5.1 Porting to SVA-OS . 47 4.5.2 MemoryAllocatorChanges . 48 4.5.3 ChangestoImproveAnalysis . 49 4.6 Experimental Results . 50 4.6.1 Performance Overheads . 50 4.6.2 Exploit Detection . 54 4.6.3 Analysis Results . 54 4.7 Related Work . 56 4.8 Summary . 58 Chapter 5 Secure Low-Level Software/Hardware Interactions . 59 5.1 Introduction.............................................. 59 5.2 Breaking Memory Safety with Low-Level Kernel Operations . 62 5.2.1 CorruptingProcessorState . 63 5.2.2 CorruptingStackState ................................... 64 5.2.3 CorruptingMemory-MappedI/O. 64 5.2.4 CorruptingCode ....................................... 65 5.2.5 GeneralMemoryCorruption . 66 5.3 Design Principles . 66 5.4 Background: Secure Virtual Architecture . 69 5.5 Design . 70 5.5.1 ContextSwitching ...................................... 70 5.5.2 ThreadManagement..................................... 71 5.5.3 MemoryMappedI/O .................................... 72 5.5.4 Safe DMA . 73 5.5.5 Virtual Memory . 73 5.5.6 Self-modifyingCode ..................................... 75 5.5.7 InterruptedState....................................... 76 5.5.8 Miscellaneous . 77 5.6 Modifications to the Linux Kernel . 77 5.6.1 ChangestoBaselineSVA-M. 77 5.6.2 Context Switching/Thread Creation . 78 5.6.3 I/O .............................................. 78 5.6.4 Virtual Memory . 78 5.7 Evaluation and Analysis . 79 5.7.1 Exploit Detection . 79 5.7.2 Performance . 81 vii 5.8 Related Work . 85 5.9 Summary . 88 Chapter 6 Control-Flow Integrity for Operating System Kernels . 89 6.1 Introduction.............................................. 89 6.2 Attack Model . 91 6.3 KCoFIInfrastructure......................................... 92 6.4 Design . 93 6.4.1 Control-flow Integrity Policy and Approach . 93 6.4.2 Protecting KCoFI Memory with Software Fault Isolation . 94 6.4.3 MMU Restrictions . 95 6.4.4 DMAandI/ORestrictions ................................. 98 6.4.5 ThreadState ......................................... 98 6.4.6 Protecting Interrupted Program State . 99 6.4.7 ThreadCreation ....................................... 101 6.4.8 ContextSwitching ...................................... 102 6.4.9 CodeTranslation....................................... 102 6.4.10 Installing Interrupt and System Call Handlers . 103 6.5 Formal Model and Proofs . ..