The design and implementation of microdrivers

Ganapathy, Vinod; Renzelmann, Matthew J.; Balakrishnan, Arini; Swift, Michael M.; Jha, Somesh

doi:10.1145/1346281.1346303

Cited by 67 publications

(24 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Nooks maintained and synchronized private copies of kernel objects between the kernel and the isolated driver, however, the synchronization code had to be developed manually. Nooks' successors, Decaf [77] and Microdrivers [32] developed static analysis techniques [77] to generate synchronization glue code directly from the kernel source. Wahbe et al [91] and later XFI [26] and BGI [14] relied on SFI to isolate kernel extensions but were not capable of handling semantically-rich boundary between the isolated subsystem and the kernel.…”

Section: Complexity Of Decompositionmentioning

confidence: 99%

Lightweight kernel isolation with virtualization and VM functions

Narayanan

Huang

Tan

et al. 2020

Proceedings of the 16th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments

View full text Add to dashboard Cite

Commodity operating systems execute core kernel subsystems in a single address space along with hundreds of dynamically loaded extensions and device drivers. Lack of isolation within the kernel implies that a vulnerability in any of the kernel subsystems or device drivers opens a way to mount a successful attack on the entire kernel.Historically, isolation within the kernel remained prohibitive due to the high cost of hardware isolation primitives. Recent CPUs, however, bring a new set of mechanisms. Extended page-table (EPT) switching with VM functions and memory protection keys (MPKs) provide memory isolation and invocations across boundaries of protection domains with overheads comparable to system calls. Unfortunately, neither MPKs nor EPT switching provide architectural support for isolation of privileged ring 0 kernel code, i.e., control of privileged instructions and well-defined entry points to securely restore state of the system on transition between isolated domains.Our work develops a collection of techniques for lightweight isolation of privileged kernel code. To control execution of privileged instructions, we rely on a minimal hypervisor that transparently deprivileges the system into a non-root VT-x guest. We develop a new isolation boundary that leverages extended page table (EPT) switching with the VMFUNC instruction. We define a set of invariants that allows us to isolate kernel components in the face of an intricate execution model of the kernel, e.g., provide isolation of preemptable, concurrent interrupt handlers. To minimize overheads of virtualization, we develop support for exitless interrupt delivery across isolated domains. We evaluate our

show abstract

Section: Complexity Of Decompositionmentioning

confidence: 99%

Lightweight kernel isolation with virtualization and VM functions

Narayanan

Huang

Tan

et al. 2020

Proceedings of the 16th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments

View full text Add to dashboard Cite

show abstract

“…The effects of vulnerabilities on these valid code paths can be mitigated by isolating device drivers from the kernel [27], [34], [38], [50]. Android, for example, switched from the kernel-space Bluetooth protocol stack [12] to a user-space Bluetooth stack [13].…”

Section: A Protection Against Peripheral Attacksmentioning

confidence: 99%

PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary

Song¹,

Hetzelt²,

Das³

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

The OS kernel is an attractive target for remote attackers. If compromised, the kernel gives adversaries full system access, including the ability to install rootkits, extract sensitive information, and perform other malicious actions, all while evading detection. Most of the kernel's attack surface is situated along the system call boundary. Ongoing kernel protection efforts have focused primarily on securing this boundary; several capable analysis and fuzzing frameworks have been developed for this purpose.

show abstract

“…Third, some existing methods may need to restructure the OS (eg, Nexus). To address the aforementioned limitations, a novel driver architecture called Microdriver is proposed. In this architecture, a driver is partitioned into a kernel‐mode component (k‐driver) and a user‐mode component (u‐driver).…”

Section: Related Workmentioning

confidence: 99%

A policy‐centric approach to protecting OS kernel from vulnerable LKMs

Tian

Xiong

et al. 2018

Softw Pract Exp

View full text Add to dashboard Cite

Loadable kernel modules (LKMs) that contain vulnerabilities are a big threat to modern operating systems (OSs). The primary reason is that there is no protection mechanism inside the kernel space when the LKM is executed. As a result, kernel module exploitation can seriously affect the OS kernel security. Although many protection systems have been developed to address this problem in the past few years, there still remain some challenges: (1) How to automatically generate a security policy before the kernel module is enforced? (2) How to properly mediate the interactions between the kernel module and the OS kernel without modifications on the existing OS, hardware, and kernel module structure? To address these challenges, we present LKM guard (LKMG), a policy-centric system that can protect commodity OS kernel from vulnerable LKMs. Compared with previous systems, LKMG is able to generate a security policy from a kernel module and then enforce the policy during the run time. Generally, the working process of LKMG can be divided into 2 stages. First, we utilize static analysis to extract the kernel code and data access patterns from a kernel module's source code and then combine these patterns with the related memory address information to generate a security policy. Second, by leveraging the hardware-assisted virtualization technology, LKMG isolates the kernel module from the rest of the kernel and then enforces the kernel module's execution to obey the derived policy. The experiments show that our system can defend against various attacks launched by the compromised kernel module effectively with moderate performance cost.

show abstract

The design and implementation of microdrivers

Cited by 67 publications

References 21 publications

Lightweight kernel isolation with virtualization and VM functions

Lightweight kernel isolation with virtualization and VM functions

PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary

A policy‐centric approach to protecting OS kernel from vulnerable LKMs

Contact Info

Product

Resources

About