ARM Pointer Authentication based Forward-Edge and Backward-Edge Control Flow Integrity for Kernels Yutian Yang, Songbo Zhu, Wenbo Shen,* Yajin Zhou, Jiadong Sun, and Kui Ren fytyang, 3160103828, shenwenbo, yajin zhou, simonsun, [email protected] Zhejiang University Abstract—Code reuse attacks are still big threats to software obtain necessary information to launch the attack, either by and system security. Control flow integrity is a promising tech- randomizing memory layout [5,6,7,8], or reducing the num- nique to defend against such attacks. However, its effectiveness ber of available gadgets [9]. However, address randomization has been weakened due to the inaccurate control flow graph has been proven to be ineffective [10, 11], since the address and practical strategy to trade security for performance. In information could be leaked or inferred. Moreover, the large recent years, CPU vendors have integrated hardware features codebase makes it impossible to totally eliminate code gadgets. as countermeasures. For instance, ARM Pointer Authentication (PA in short) was introduced in ARMV8-A architecture. It can The second category includes systems to protect the integrity efficiently generate an authentication code for an address, which of control flow (CFI in short) [12, 13, 14]. Though CFI is a is encoded in the unused bits of the address. When the address promising technique, its effectiveness has been weakened [15] is de-referenced, the authentication code is checked to ensure its due to the inaccurate control flow graph and the practical integrity. Though there exist systems that adopt PA to harden strategy to trade security for performance. user programs, how to effectively use PA to protect OS kernels is still an open research question. In recent years, hardware-assisted control flow enforce- ment [16, 17] has drawn much attention. These systems In this paper, we shed lights on how to leverage PA to protect mainly borrow hardware features that were designed for other control flows, including function pointers and return addresses, of purposes. Nowadays, vendors have directly embedded secu- Linux kernel. Specifically, to protect function pointers, we embed rity features for CFI in modern CPUs. For instance, ARM authentication code into them, track their propagation and verify their values when loading from memory or branching to targets. introduced Pointer Authentication (PA) in ARMv8.3 [18]. To further defend against the pointer substitution attack, we use Specifically, it reuses unused bits in the virtual address of the the function pointer address as its context, and take a clean design ARM64 architecture to calculates and embed an authentication to propagate the address by piggybacking it into the pointer value. code for the pointer, thus the name Pointer Authentication We have implemented a prototype system with LLVM to identify Code (PAC). When the pointer is de-referenced, the embedded function pointers, add authentication code and verify function authentication code could be used to verify its validity by the pointers by emitting new machine instructions. We applied this hardware. To facilitate its use, multiple instructions are added. system to Linux kernel, and solved numerous practical issues, e.g., function pointer comparison and arithmetic operations. The Since its debut, PA has been considered as a promising security analysis shows that our system can protect all function defense due to its powerful security guarantees and efficient pointers and return addresses in Linux kernel. pointer value verification [19]. However, to leverage this feature, programmers need to change and recompile their I. INTRODUCTION programs to use the new instructions. Though a couple of papers are adopting PA to protect code and data pointers in user arXiv:1912.10666v2 [cs.CR] 12 Oct 2020 Since the first emerging in the 1990s [1], code reuse attack programs [20, 21, 22], there is no open implementations that has become a big threat to software and system security, leverage PA to protect privileged software, i.e., OS kernel 1. especially after code injection has been defeated by hardware Due to the differences between OS and user programs (for features, including NX/SMEP/SMAP on x86 and XN/PXN/- instance, while user programs could assume that the underlying PAN on ARM. Specifically, after hijacking the control flow kernel is trusted to provide cryptography keys to generate through memory corruption, attackers could chain existing the authentication code, OS kernels cannot make such an code snippets (called code gadgets) together to perform ma- assumption), how to effectively use PA to protect OS kernel licious operations. This is called return-oriented programming is still an open research question. (ROP in short) [2,3]. Previous studies showed that given a large codebase (such as Linux kernel or libc), ROP has been Our work In this paper, we shed lights on how to leverage shown to be Turing complete [4], making it a powerful attack. PA to protect control flows of OS kernels, and present the first design and implementation of such a system. Specifically, we To defend against the ROP attack, multiple solutions have propose PATTER, which is short for Pointer AuThenTication been proposed, which are roughly falling into two categories. for kERnels, protects both function pointers and return ad- The first category includes systems to make attackers hard to 1We are aware that Apple has adopted PA in its latest version of iOS XNU *Corresponding author. kernel. However, its implementation details are unknown. dresses in Linux kernel, thus providing both forward- and 63 55 54 48 (VA_BIT) LO/HI backward-edge control flow integrity. To the best of our MT/PAC PAC knowledge, it is the first open implementation of applying PA to Linux kernel. Fig. 1: ARMv8.3 Pointer Format with Pointer Authentication. In order to leverage PA to provide complete protection of The Pointer Authentication Code (PAC) is embedded into the function pointers, PATTER needs to append the authentication unused bits of a pointer. code to the value of a function pointer 2, track the propagation of function pointers, and verify its validity when loading all its value from memory or branching to the jump target. The security analysis shows that PATTER can protect the Specifically, PATTER calculates an authentication code (PAC) function pointers and return addresses in Linux kernel, with a 15 25% for each function pointer (we call the function pointer with an performance overhead between % to , using the micro authentication code as a PACed pointer) before it is written benchmark of system calls. into memory. The PAC is computed using the combination This paper has the following contributions: of a hardware cryptography key, the function pointer value, and a context. Then PATTER tracks the propagation of the • We propose the first design of using the ARM pointer function pointer with the help of the LLVM compiler. When authentication to protect control flow transfers of a PACed pointer is loaded from the memory, PATTER verifies Linux kernels. Our design protects all function point- the value to ensure that it has not been modified (attackers have ers and return addresses in Linux kernel, thus pro- arbitrary memory write capability). However, the previous step viding both forward-edge and backward-edge control is not enough since an attacker could directly jump before flow integrity. the instruction that dereferences a function pointer (the blr • To implement PATTER, we have proposed a series instruction for instance). In this case, PATTER verifies the of new techniques to solve technical challenges. In jump target in indirect branch instructions before jumping to particular, we proposed address-base authentication it. code generation to defend against pointer substitution When calculating the authentication code, unlike the pre- attacks, and pointer address piggyback to propagate vious work that leverages the function type as a context [20], function pointer address. We also proposed methods PATTER takes the address of a function pointer as its context. to identify function pointers, and verify them when That’s because for each function pointer, the function type loading, storing their values, and branching into tar- is not unique. Attackers could obtain the PACed function gets. pointer and reuse it for another function pointer. This is called • We have implemented a prototype of PATTER based pointer substitution attack. By using the unique address of a on the latest Clang/LLVM and applied it to protect the function pointer as its context, PATTER is immune to this latest version of the Linux kernel. PATTER success- attack. However, the challenge is the location of de-referencing fully protects 100% of indirect call sites and return a function pointer may be far from the location where it is addresses. loaded, thus we need to propagate the address of a function pointer between procedures. PATTER takes a clean design to The organization of this paper is as follows: background piggyback the pointer address into the pointer value (Figure4) knowledge is given in §II.§III discusses the threat model and to solve this problem. assumptions. PATTER design is presented in detail inIV. We discuss the implementation details in §V and evaluate both To protect return addresses, PATTER will generate the PAC the security and performance of PATTER in §VI. We compare for a return address before saving it to the stack and check the PATTER with related works in §VII. Finally, we conclude the PAC after loading it from the stack. The stack pointer is used whole paper in §VIII. as the context, so that the signed return addresses cannot be replayed across different stack frames. As a result, the return II. BACKGROUND address corruption and return address replay attacks will be defeated by PATTER. Moreover, different from existing works, In this section, we give preliminary background knowledge PATTER uses a single instruction to authenticate the loading of the techniques used by this paper, including pointer authen- return address and return it atomically, which defeats the time tication and ROP/JOP attacks.