SecVisor

Abstract

We propose SecVisor, a tiny hypervisor that ensures code integrity for commodity OS kernels. In particular, SecVisor ensures that only user-approved code can execute in kernel mode over the entire system lifetime. This protects the kernel against code injection attacks, such as kernel rootkits. SecVisor can achieve this propertyeven against an attacker who controls everything but the CPU, the memory controller, and system memory chips. Further, SecVisor can even defend against attackers with knowledge of zero-day kernel exploits. Our goal is to make SecVisor amenable to formal verificationand manual audit, thereby making it possible to rule out known classes of vulnerabilities. To this end, SecVisor offers small code size and small external interface. We rely on memory virtualization to build SecVisor and implement two versions, one using software memory virtualization and the other using CPU-supported memory virtualization. The code sizes of the runtime portions of these versions are 1739 and 1112 lines, respectively. The size of the external interface for both versions of SecVisor is 2 hypercalls. It is easy to port OS kernels to SecVisor. We port the Linux kernel version 2.6.20 by adding 12 lines and deleting 81 lines, out of a total of approximately 4.3 million lines of code in the kernel.

Containing a Confused Deputy on x86: A Survey of Privilege Escalation Mitigation Techniques

“…This conforms to expectations in that the more thorough the security [45] CF 5579 SVA [44] M & CF No Data SecVisor [41] M 4092 SBCFI [46] CF No Data kGuard [22] CF 1000 PaX [49], [50] M & CF No Data Return-less Kernel [48] CF 2100…”

“…SecVisor [41] is an alternative virtualization technology leveraging hardware facilities to virtualize physical memory associated with modern processors. By utilizing this additional layer of translation from "guest physical" to "real physical" memory addresses, additional hardware memory protections can be enforced.…”

Toward the Verification of a Simple Hypervisor

“…Our initial code base was extracted from CMU's SecVisor's code [25]. However, we made various simplifications to eliminate functionality orthogonal to our concerns and to simplify our initial proof target.…”

“…Several research efforts have demonstrated that it is possible to construct small, robust and useful hypervisors. The SecVisor project [25] implemented two hypervisors (1739 and 1112 lines of code, respectively) supporting Linux kernel version 2.6.20. Their systems provide strong integrity guarantees.…”

“…Though our target hypervisor, called MinVisor, runs only one guest, its features provide some of the minimum requirements of typical hypervisors and provide some of the guarantees of CMU's SecVi-sor [25], a simple research hypervisor that we used as our initial jumping off point. Thus, MinVisor provides a simplified but useful platform on which to carry out our initial verification efforts.…”