KASLR-MT: Kernel Address Space Layout Randomization for Multi-Tenant cloud systems

Vañó-García, Fernando; Marco-Gisbert, Héctor

doi:10.1016/j.jpdc.2019.11.008

Cited by 9 publications

(8 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One of the problems that the standard coarse-grained kernel randomization approach raises is that it is not compatible with memory deduplication when both methods are applied in environments based on virtualization technologies [35]. In addition, since the randomization is applied at boot time and unchanged until next reboot, any info-leak disclosing a specific chunk of a kernel memory region, it is actually uncovering the location of the entire kernel memory region, thus circumventing the KASLR protection for that particular region.…”

Section: B Standard Linux Kaslrmentioning

confidence: 99%

Section: Kaslr-mtmentioning

confidence: 99%

“…Kernel Address Space Layout Randomization Multi-Tenant (KASLR-MT) [35] is a kernel randomization solution for multi-tenant cloud systems that remedies the problem of memory deduplication cancellation caused by the randomization effects on guest memory contents. KSM and KASLR techniques conflict when both are enabled in virtualized systems such as cloud environments [35], [38]. The reason is that the randomization of kernel memory regions causes undesired effects on the memory sharing effectiveness of KSM because the latter tries to merge host memory pages with identical content while guest kernel randomization introduces differences in the memory contents of the guest virtual machine.…”

Section: Kaslr-mtmentioning

confidence: 99%

“…Section II-C briefly outlines the problem that affects memory sharing and the efficient utilization of memory resources when deduplication mechanisms such as KSM are combined with address randomization security mechanisms such as KASLR, especially in environments that rely on virtualization technologies. This issue was explored in previous research [35], [38], providing solutions for the standard coarsegrained kernel randomization approach. However, motivated by info-leak attacks, newer and more secure kernel ran-This work is licensed under a Creative Commons Attribution 4.0 License.…”

Section: The Problem: Relative Offsetsmentioning

confidence: 99%

“…In standard kernel randomization, the absolute references breaks shareability when the kernel is randomized [35] due to text relocations, dynamically patching, etc. The kernel code is the most affected memory area and this is because all kernel code pages that are dynamically patched by absolute relocations at boot-time cannot be merged.…”

Section: Memory Ofmentioning

confidence: 99%

See 4 more Smart Citations

An Info-Leak Resistant Kernel Randomization for Virtualized Systems

Vañó-García

Marco-Gisbert

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

Given the significance that the cloud paradigm has in modern society, it is extremely important to provide security to users at all levels, especially at the most fundamental ones since these are the most sensitive and potentially harmful in the event of an attack. However, the cloud computing paradigm brings new challenges in which security mechanisms are weakened or deactivated to improve profitability and exploitation of the available resources. Kernel randomization is an important security mechanism that is currently present in all main operating systems. Function-Granular Kernel Randomization is a new step that aims to be the future of the kernel randomization, because it provides much more security than current kernel randomization approaches. Unfortunately, function-granular kernel randomization also impacts significantly on the performance and potential benefits of memory deduplication. Both functiongranular kernel randomization and memory deduplication are desired and beneficial; the first for the strong protection it gives, and the second for the reduction of costs in terms of memory consumption. In this paper, we analyse the impact of function-granular kernel randomization on memory deduplication revealing why it cannot offer maximum security and shareability of memory simultaneously. We also discuss the reasons why having a full position independent kernel code counter-intuitively does not solve the problem introducing a challenge to kernel randomization designers. To solve these problems, we propose a functiongranular kernel randomization modification for cloud systems that enables full function-granular kernel randomization while reduces memory deduplication cancellations to almost zero. The proposed approach forces guest kernels of the same tenant to have the same random memory layout of memory regions with high impact on deduplication, ensuring a high rate of deduplicated pages while the kernel randomization is fully enabled. Our approach enables cloud providers to have both, high levels of security and an efficient use of resources.

show abstract

Section: B Standard Linux Kaslrmentioning

confidence: 99%

Section: Kaslr-mtmentioning

confidence: 99%

Section: Kaslr-mtmentioning

confidence: 99%

Section: The Problem: Relative Offsetsmentioning

confidence: 99%

Section: Memory Ofmentioning

confidence: 99%

See 3 more Smart Citations

An Info-Leak Resistant Kernel Randomization for Virtualized Systems

Vañó-García

Marco-Gisbert

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

Editorial

Reaño

Silla

Varghese

2021

Journal of Parallel and Distributed Computing

View full text Add to dashboard Cite

E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems

Vañó-García

Marco-Gisbert

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

Due to the impracticability of generating true randomness by running deterministic algorithms in computers, boot-loaders and operating systems undergo the lack of enough supplies of entropy at boot-time. This problem remains a challenge and affects all computer systems, including virtualization technologies. Unfortunately, this situation leads to undesired side effects, affecting the security of important kernel components and causing large blocking waits in the start-up of userland processes. For example, SSHD is delayed up to 4 minutes. In this paper, we analyze the boot-time entropy starvation problem, performing a comprehensive analysis of the Linux kernel boot process revealing that the problem not only affects userland applications but up to 33 kernel functions at boot time. Those functions are weakly fed by random numbers from a non-initialized CSPRNG. To overcome this problem, we propose E-Boot, a novel technique that provides high-quality random numbers to guest virtual machines. E-Boot is the first technique that completely satisfies the entropy demand of virtualized boot-loaders and operating systems at boot time. We have implemented E-Boot in Linux v5.3 and our experiments show that it effectively solves the boot-time entropy starvation problem. Our proposal successfully feeds bootloaders and boot time Linux kernel hardening techniques with high-quality random numbers, reducing also to zero the number of userspace blocks and delays. The total time overhead introduced by E-Boot is around 2 µs and has zero memory overhead, since the memory is freed before the kernel boot ends, which makes E-boot a practical solution for cloud systems.

show abstract

KASLR-MT: Kernel Address Space Layout Randomization for Multi-Tenant cloud systems

Cited by 9 publications

References 23 publications

An Info-Leak Resistant Kernel Randomization for Virtualized Systems

An Info-Leak Resistant Kernel Randomization for Virtualized Systems

Editorial

E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems

Contact Info

Product

Resources

About