KMO: Kernel Memory Observer to Identify Memory Corruption by Secret Inspection Mechanism

Kuzuno, Hiroki; Yamauchi, Toshihiro

doi:10.1007/978-3-030-34339-2_5

Cited by 3 publications

(13 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, this paper highlights the contribution differences from the previous paper in [16]. Although this paper is based on conference proceedings in [7], [16], the present paper provides additional design, evaluation results, and implementation portability. Additionally, this paper introduced the general concept of MKM that can mitigate the memory corruption for running kernel and actual kernel vulnerability attacks that cannot break the security capability of MKM in [16].…”

Section: Introductionmentioning

confidence: 88%

“…Moreover, MKM has additional overheads when switching between the trampoline and security kernel page tables in kernel mode. The kernel observation mechanism requires additional overhead time of approximately 0.002 µs to 8.246 µs for each system call invocation in [7].…”

Section: B Performancementioning

confidence: 99%

“…In [40], the authors provide low overhead kernel separation using the extended page table on Intel CPUs. Additionally, in [7], the authors demonstrated the KMO provides a dedicated page table to isolate kernel protection methods from other kernel code. An approach was proposed by Österlund et al [41] showcases that the kernel multi-variant execution supports differential virtual address spaces and stack behaviors to identify the success or failure of attacks from anomalous process.…”

Section: B Inside Kernelmentioning

confidence: 99%

“…Table 7 shows a comparison of the security features of MKM and those of five attack surface reducing mechanisms in [7], [36]- [39]. To satisfy most attack mitigation requirements, MKM provides attack mitigation method, whereby the kernel memory is separated or minimized to mitigate the attack code and protect the kernel.…”

Section: ) Feature Comparisonmentioning

confidence: 99%

“…Another study conducted in [6] proposed the control flow integrity (CFI), which verifies a relation of kernel code invocations to prevent the execution of malicious programs with modifications of the return address. Moreover, the kernel memory observer (KMO) segregates the kernel monitoring code in the dedicated kernel address space in [7].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Mitigation of Kernel Memory Corruption Using Multiple Kernel Memory Mechanism

Kuzuno¹,

Yamauchi

2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

Operating systems adopt kernel protection methods (e.g., mandatory access control, kernel address space layout randomization, control flow integrity, and kernel page table isolation) as essential countermeasures to reduce the likelihood of kernel vulnerability attacks. However, kernel memory corruption can still occur via the execution of malicious kernel code at the kernel layer. This is because the vulnerable kernel code and the attack target kernel code or kernel data are located in the same kernel address space. To gain complete control of a host, adversaries focus on kernel code invocations, such as function pointers that rely on the starting points of the kernel protection methods. To mitigate such subversion attacks, this paper presents multiple kernel memory (MKM), which employs an alternative design for kernel address space separation. The MKM mechanism focuses on the isolation granularity of the kernel address space during each execution of the kernel code. MKM provides two kernel address spaces, namely, i) the trampoline kernel address space, which acts as the gateway feature between user and kernel modes and ii) the security kernel address space, which utilizes the localization of the kernel protection methods (i.e., kernel observation). Additionally, MKM achieves the encapsulation of the vulnerable kernel code to prevent access to the kernel code invocations of the separated kernel address space. The evaluation results demonstrated that MKM can protect the kernel code and kernel data from a proof-of-concept kernel vulnerability that could lead to kernel memory corruption. In addition, the performance results of MKM indicate that the system call overhead latency ranges from 0.020 µs to 0.5445 µs, while the web application benchmark ranges from 196.27 µs to 6,685.73 µs for each download access of 100,000 Hypertext Transfer Protocol sessions. MKM attained a 97.65% system benchmark score and a 99.76% kernel compilation time.

show abstract

Section: Introductionmentioning

confidence: 88%

Section: B Performancementioning

confidence: 99%

Section: B Inside Kernelmentioning

confidence: 99%

Section: ) Feature Comparisonmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Mitigation of Kernel Memory Corruption Using Multiple Kernel Memory Mechanism

Kuzuno¹,

Yamauchi

2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

MKM: Multiple Kernel Memory for Protecting Page Table Switching Mechanism Against Memory Corruption

Kuzuno

Yamauchi

2020

Advances in Information and Computer Security

Self Cite

View full text Add to dashboard Cite

Countermeasures against kernel vulnerability attacks on an operating system (OS) are highly important kernel features. Some kernels adopt several kernel protection methods such as mandatory access control, kernel address space layout randomization, control flow integrity, and kernel page table isolation; however, kernel vulnerabilities can still be exploited to execute attack codes and corrupt kernel memory. To accomplish this, adversaries subvert kernel protection methods and invoke these kernel codes to avoid administrator privileges restrictions and gain complete control of the target host. To prevent such subversion, we present Multiple Kernel Memory (MKM), which offers a novel security mechanism using an alternative design for kernel memory separation that was developed to reduce the kernel attack surface and mitigate the effects of illegal data manipulation in the kernel memory. The proposed MKM is capable of isolating kernel memory and dedicates the trampoline page table for a gateway of page table switching and the security page table for kernel protection methods.The MKM encloses the vulnerable kernel code in the kernel page table. The MKM mechanism achieves complete separation of the kernel code execution range of the virtual address space on each page table. It ensures that vulnerable kernel code does not interact with different page tables. Thus, the page table switching of the trampoline and the kernel protection methods of the security page tables are protected from vulnerable kernel code in other page tables. An evaluation of MKM indicates that it protects the kernel code and data on the trampoline and security page tables from an actual kernel vulnerabilities that lead to kernel memory corruption. In addition, the performance results show that the overhead is 0.020 µs to 0.5445 µs, in terms of the system call latency and the application overhead average is 196.27 µs to 6,685.73 µs , for each download access of 100,000 Hypertext Transfer Protocol sessions.

show abstract

Identification of Kernel Memory Corruption Using Kernel Memory Secret Observation Mechanism

Kuzuno

Yamauchi

2020

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

KMO: Kernel Memory Observer to Identify Memory Corruption by Secret Inspection Mechanism

Cited by 3 publications

References 30 publications

Mitigation of Kernel Memory Corruption Using Multiple Kernel Memory Mechanism

Mitigation of Kernel Memory Corruption Using Multiple Kernel Memory Mechanism

MKM: Multiple Kernel Memory for Protecting Page Table Switching Mechanism Against Memory Corruption

Identification of Kernel Memory Corruption Using Kernel Memory Secret Observation Mechanism

Contact Info

Product

Resources

About