DOUG GOLDSTEIN STAR LAB XEN SUMMIT AUG 2016 ATTACK SURFACE REDUCTION

Size: px

Start display at page:

Download "DOUG GOLDSTEIN STAR LAB XEN SUMMIT AUG 2016 ATTACK SURFACE REDUCTION"

Judith Farmer
5 years ago
Views:

1 DOUG GOLDSTEIN STAR LAB XEN SUMMIT AUG 2016 ATTACK SURFACE REDUCTION

2 OVERVIEW TOPICS Define attack surface Discuss parts of Xen s attack surface Attack surface metrics for Xen Define attack surface reduction What we ve accomplished to date Identify ways to reduce Xen s attack surface

3 DEFINTION ATTACK SURFACE Any privileged code with an interface (intentional or not) accessible by domains or OOB Before you can protect a system, you must understand your attack surface Best to break the model into functional-, design-, or role- based views Unfortunately its difficult to provide a metric on attack surface for a component but some items that are used but problematic lines of code CVEs relative complexity

4 METRICS LINES OF CODE Not as granular as we really want to get but good enough for this talk Used git tags and not the tarballs Hypervisor k k or ~4% gain k or ~10% gain Tools k k or ~4% gain k or ~4% gain

5 METRICS VULNERABILITIES & COMPLEXITY CVEs for all of Xen CVEs CVEs or ~60% increase CVEs to date (~65% of the way through the year) or ~ 45% decrease to date Complexity Anything that is developed relying on the Intel IA manual has a high degree of complexity

6 ATTACK SURFACE OF XEN HYPERVISOR hypercalls - many are unused based on PV or HVM instruction emulation - emulate in place SMM (x86) - management software / hardware that s under you hypervisors nesting - root hypervisor owns you DMA - evil devices or misconfigured devices live patch - run this code as ring -1 please migration / introspection - ability to peek into guest memory

7 ATTACK SURFACE OF XEN DOM0 qemu device model (i440fx) and all of its devices permissions root vs de-priv vs root in a container ability to open files, connections affect memory in the guest runs in dom0 by default legacy kernel APIs that are unused or untested missing or crashed daemons migration

8 DEFINITION ATTACK SURFACE REDUCTION The mitigation of security risks through the reduction of code exposed to users reduced feature sets aka reducing lines of code If you don t need a feature, don t build it in compartmentalizing to reduce scope of a feature aka reducing permissions

9 IMPROVEMENTS WAYS TO REDUCE THE ATTACK SURFACE WITH 4.7 hypervisor Kconfig - able to disable 14k LOC and at least 1 CVE XSM/Flask - reduce permissions by only having the access you need IOMMU - iommu=force hypervisor data pages marked R/O dom0 stubdoms - device model and xenstore disaggregate the hardware domain(s) from control domain pvgrub2 Unfortunately this is mostly disabled by default

10 ATTACK SURFACE REDUCTION HYPERVISOR Kconfig PVH / HVM / PV hypercall sets instruction emulation require hardware support and remove software fallbacks new features added should be Kconfig d but how will testing and graduating from preview work? add a STM (SMM transfer mode) to Xen signature checks for live patch

11 ATTACK SURFACE REDUCTION HYPERVISOR CONT D refactor instruction emulation (emulate in place vs emulate and modify) seccomp for hypercalls XSM/Flask by default make non-migratable / non-introspectable domains encrypted memory mode for nested hypervisor or domain SGX v3+ or AMD Secure Memory v2+

12 ATTACK SURFACE REDUCTION DOM0 granular ability to enable new features qemu migrate to q35 device model strongly consider using seccomp or unshare dynamically mark a VM unmigratable ship less qemu scripts need bash, python and perl

13 ATTACK SURFACE REDUCTION COMPARTMENTALIZATION One of the leading advantages of Xen over KVM and other HVs Xen really shines in this part of the security space Qubes / OpenXT / SecureView / Crucible Don t make security in Xen hard. Make it default. XSM/Flask proper policy can really limit the damage that can be done hardware domain vs control domain full MILS separation can not be achieved today however

14 ATTACK SURFACE REDUCTION COMPARTMENTALIZATION CONT D xenstore provides configuration parameters for front/back no way to limit what data can be shared between domains allowed to communicate with existing DAC xenstore-rs written in Rust for type and memory safety provides Flask-based security server and access vector cache supports Linux based dom0 (FreeBSD should work too) post-1.0 goals include support stubdom via Rust target for Xen

15 OVERVIEW SUMMARY Defined attack surface Provided some examples of attack surface Reviewed parts Xen s attack surface Discussed attack surface reduction Provided some examples of attack surface reduction Identified ways to reduce Xen s attack surface

16 Questions?

Towards a configurable and slimmer x86 hypervisor

Towards a configurable and slimmer x86 hypervisor Liu Wei Budapest July 11-13, 2017 Current state of affairs PV mode: no hardware extension needed, used in legacy systems, useful in certain cases like