Fine-Grained Control-Flow Integrity for Kernel Software

Abstract

Modern systems assume that privileged software always behaves as expected, however, such assumptions may not hold given the prevalence of kernel vulnerabilities. One idea is to employ defenses to restrict how adversaries may exploit such vulnerabilities, such as Control-Flow Integrity (CFI), which restricts execution to a Control-Flow Graph (CFG). However, proposed applications of CFI enforcement to kernel software are too coarse-grained to restrict the adversary effectively and either fail to enforce CFI comprehensively or are very expensive.We present a mostly-automated approach for retrofitting kernel software that leverages features of such software to enable comprehensive, efficient, fine-grained CFI enforcement. We achieve this goal by leveraging two insights. We first leverage the conservative function pointer usage patterns found in the kernel source code to develop a method to compute fine-grained CFGs for kernel software. Second, we identify two opportunities for removing CFI instrumentation relative to prior optimization techniques: reusing existing kernel instrumentation and creating direct transfers, where possible. Using these insights, we show how to choose optimized defenses for kernels to handle system events, enabling comprehensive and efficient CFI enforcement.We evaluate the effectiveness of the proposed fine-grained CFI instrumentation by applying the retrofitting approach comprehensively to FreeBSD, the MINIX microkernel system, and MINIX's user-space servers, and applying this approach partly to the BitVisor hypervisor. We show that our approach eliminates over 70% of the indirect targets relative to the best current, fine-grained CFI techniques, while our optimizations reduce the instrumentation necessary to enforce coarse-grained CFI. The performance improvement due to our optimizations ranges from 51%/25% for MINIX to 12%/17% for FreeBSD for the average/maximum microbenchmark overhead. The evaluation shows that fine-grained CFI instrumentation can be computed for kernel software in practice and can be enforced more efficiently than coarse-grained CFI instrumentation.

Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features

“…This approach can be applied to a wider range of kernel software and prevents more attacks than KRGuard. On the other hand, as mentioned above, because KRGuard deploys the hardware function LBR and limits the target function, the overhead of KRGuard is smaller than that of [13]. In addition, we think that KRGuard can easily be applied to the Linux kernel because the mechanism is very simple.…”

“…Ge et al [13] proposed a mostly automated approach to produce and enforce fine-grained CFI policies comprehensively for kernel software with low overhead. This approach can be applied to a wider range of kernel software and prevents more attacks than KRGuard.…”

Analyzing control flow integrity with LLVM-CFI

“…Further, we are particularly interested in calltarget reduction analysis as this is the most used metric (see AIR [59], fAIR [49], and AIA [16] -however, these metrics average the results) to compare CFI defenses against each other. At the time of writing this paper, none of the existing CFI metrics can tell how secure a program is after a certain CFI policy was applied; as such, we do not claim that by using our CT R metric we can provide more security guarantees than other metrics, but rather CT R provides absolute values rather than averaging them.…”

Object Flow Integrity

“…In addition to securing user-level application software against such threats, it has also been applied to harden smartphones [14,39,49], embedded systems [3], hypervisors [63], and operating system kernels [13,25,33]. CFI-enforcing hardware is also being investigated [15,16,18,24,28,42,68,70].…”