Enhanced Operating System Security Through Efficient and Fine-grained Address Space Randomization

Transcription

1 Enhanced Operating System Security Through Efficient and Fine-grained Address Space Randomization Anton Kuijsten Andrew S. Tanenbaum Vrije Universiteit Amsterdam 21st USENIX Security Symposium Bellevue, WA, USA August 8-10, / 19

2 Kernel-level Exploitation Kernel-level exploitation increasingly gaining momentum. Many exploits available for Windows, Linux, BSD, Mac OS X, ios. Plenty of memory error vulnerabilities to choose from. Plethora of internet-connected users running the same kernel version. Many attack opportunities for both local and remote exploits. 2 / 19

3 Existing Countermeasures Preserving kernel code integrity [SecVisor, NICKLE, hvmharvard]. Kernel hook protection [HookSafe, HookScout, Indexed hooks]. Control-flow integrity [SBCFI]. No comprehensive memory error protection. Virtualization support required, high overhead. 3 / 19

4 Address Space Randomization Well-established defense mechanism against memory error exploits. Application-level support in all the major operating systems. The operating system itself typically not randomized at all. Only recent Windows releases perform basic text randomization. Goal: Fine-grained ASR for operating systems. 4 / 19

5 Challenges in OS-level ASR Instrumentation 5 / 19

6 Challenges in OS-level ASR Rerandomization 5 / 19

7 Challenges in OS-level ASR Information leakage 5 / 19

8 Challenges in OS-level ASR Brute forcing 5 / 19

9 A Design for OS-level ASR Make both location and layout of memory objects unpredictable. LLVM-based link-time transformations for safe and efficient ASR. Minimal amount of untrusted code exposed to the runtime. Live rerandomization to maximize unobservability of the system. No changes in the software distribution model. 6 / 19

10 Architecture 7 / 19

11 Code Randomization Original function (LLVM IR) 8 / 19

12 Code Randomization Randomize function location 8 / 19

13 Code Randomization Add random-sized padding 8 / 19

14 Code Randomization Basic block shifting 8 / 19

15 Static Data Randomization Original variable and type (LLVM IR) 9 / 19

16 Static Data Randomization Randomize variable location 9 / 19

17 Static Data Randomization Add random-sized padding 9 / 19

18 Static Data Randomization Internal layout randomization 9 / 19

19 Stack Randomization Stack frame Previous frame Parameters Return address Saved base pointer Local variables New stack frame Previous frame Inter-frame padding Parameters Return address Saved base pointer Nonbuffer variables Intra-frame padding Buffer variables 10 / 19

20 Dynamic Data Randomization Support for malloc()/mmap()-like allocator abstractions. Memory mapped regions are fully randomized. Heap allocations are interleaved with random-sized padding. Full heap randomization enforced at live rerandomization time. ILR for all the dynamically allocated memory objects. 11 / 19

21 Live Rerandomization First stateful live rerandomization technique. Periodically rerandomize the memory address space layout. Support arbitrary memory layout changes at rerandomization time. Support all the standard C idioms with minimal manual effort. Sandbox the rerandomization code to recover from run-time errors. 12 / 19

22 ASRR Transformations 13 / 19

23 ASRR Metadata Types Global variables Static variables String constants Functions Dynamic memory allocations 14 / 19

24 The Rerandomization Process 15 / 19

25 The Rerandomization Process 15 / 19

26 The Rerandomization Process 15 / 19

27 The Rerandomization Process 15 / 19

28 The Rerandomization Process 15 / 19

29 The Rerandomization Process 15 / 19

30 The Rerandomization Process 15 / 19

31 The Rerandomization Process 15 / 19

32 ASR Performance Normalized execution time ASR instrumentation ASR+ASRR instrumentation gcc perlbench bzip2 devtools SPEC average sphinx3 lbm h264ref libquantum sjeng hmmer gobmk milc mcf 16 / 19

33 ASRR Performance SPEC CPU 2006 benchmarks devtools benchmark Runtime overhead (%) Rerandomization latency (s) 17 / 19

34 Summary A new fine-grained ASR technique for operating systems. Better performance and security than prior ASR solutions. Live rerandomization and ILR to counter information leakage. No heavyweight instrumentation exposed to the runtime. Process-based isolation to recover from run-time ASRR errors. 18 / 19

35 Enhanced Operating System Security Through Efficient and Fine-grained Address Space Randomization Thank you! Any questions?, Anton Kuijsten, Andy Tanenbaum Vrije Universiteit Amsterdam