A policy‐centric approach to protecting OS kernel from vulnerable LKMs
Abstract
Loadable kernel modules (LKMs) that contain vulnerabilities are a big threat to modern operating systems (OSs). The primary reason is that there is no protection mechanism inside the kernel space when the LKM is executed. As a result, kernel module exploitation can seriously affect the OS kernel security. Although many protection systems have been developed to address this problem in the past few years, there still remain some challenges: (1) How to automatically generate a security policy before the kernel module is enforced? (2) How to properly mediate the interactions between the kernel module and the OS kernel without modifications on the existing OS, hardware, and kernel module structure? To address these challenges, we present LKM guard (LKMG), a policy‐centric system that can protect commodity OS kernel from vulnerable LKMs. Compared with previous systems, LKMG is able to generate a security policy from a kernel module and then enforce the policy during the run time. Generally, the working process of LKMG can be divided into 2 stages. First, we utilize static analysis to extract the kernel code and data access patterns from a kernel module's source code and then combine these patterns with the related memory address information to generate a security policy. Second, by leveraging the hardware‐assisted virtualization technology, LKMG isolates the kernel module from the rest of the kernel and then enforces the kernel module's execution to obey the derived policy. The experiments show that our system can defend against various attacks launched by the compromised kernel module effectively with moderate performance cost.
Document Details
- Document Type
- Pub Defense Publication
- Publication Date
- Mar 08, 2018
- Source ID
- 10.1002/spe.2576
Entities
People
- Changzhen Hu
- Donghai Tian
- Peng Liu
- Xi Xiong
Organizations
- Army Research Office
- Beijing Institute of Technology
- Institute of Information Engineering
- Meta
- National Natural Science Foundation of China
- National Science Foundation
- Pennsylvania State University