KCoFI: Complete Control-Flow Integrity for Commodity Operating System Kernels

Abstract

We present a new system, KCoFI, that is the first we know of to provide complete Control-Flow Integrity protection for commodity operating systems without using heavyweight complete memory safety. Unlike previous systems, KCoFI protects commodity operating systems from classical controlflow hijack attacks, return-to-user attacks, and code segment modification attacks. We formally verify a subset of KCoFI's design by modeling several features in small-step semantics and providing a partial proof that the semantics maintain control-flow integrity. The model and proof account for operations such as page table management, trap handlers, context switching, and signal delivery. Our evaluation shows that KCoFI prevents all the gadgets found by an open-source Return Oriented Programming (ROP) gadget-finding tool in the FreeBSD kernel from being used; it also reduces the number of indirect control-flow targets by 98.18%. Our evaluation also shows that the performance impact of KCoFI on web server bandwidth is negligible while file transfer bandwidth using OpenSSH is reduced by an average of 13%, and at worst 27%, across a wide range of file sizes. PostMark, an extremely file-system intensive benchmark, shows 2x overhead. Where comparable numbers are available, the overheads of KCoFI are far lower than heavyweight memory-safety techniques.

Micro-Policies: Formally Verified, Tag-Based Security Monitors

“…However, recent attacks against coarse-grained CFI [35], [46] have illustrated the security risks of imprecision. This has spurred interest in fine-grained CFI [30], [60], [69], sometimes called complete or ideal CFI; however, this has been deemed "very expensive" [46]. Several proposed hardware mechanisms are directly targeted at speeding up CFI [21], [34]; here we achieve CFI using a generic hardware mechanism in a formally verified way.…”

“…The PUMP mechanism supports finegrained CFI with average runtime overheads below 2% [39]. Previous formal verification efforts for CFI include ARMor [89] and KCoFI [30]. Like most work on CFI, they use inline reference monitoring [44]; their verification targets a small-TCB component, which validates that the right checks were inserted in the instrumented binary before its execution is allowed.…”

“…This ensures a very small TCB but also extremely long validation times [63]. The verification of KCoFI [30] targets a relatively compact Coq model that only focuses on certain aspects and is not related formally to the implementation.…”

Trustworthy Memory Isolation of Linux on Embedded Devices

“…This isolation can be used both to protect applications from an untrusted OS as well as to protect the OS itself from internal threats. For example, KCoFI [7] uses Secure Virtual Architecture [9] to isolate the OS from a run-time checker. The checker instruments the OS and monitors its activities to guarantee the control-flow integrity of the OS itself.…”

“…Virtualization-like mechanisms can also be used to support various forms of application hardening against untrusted OSs. Examples of this include KCoFi [7] based on the Secure Virtual Architecture [9], Overshadow [5], Inktag [14], and Virtual Ghost [8]. All these cases rely crucially on memory isolation to provide the required security guarantees, typically by virtualizing the memory management unit (MMU) hardware.…”