DMCA
kGuard: Lightweight Kernel Protection against Return-to-user Attacks
Cached
Download Links
| Citations: | 17 - 3 self |
BibTeX
@MISC{Kemerlis_kguard:lightweight,
author = {Vasileios P. Kemerlis and Georgios Portokalidis and Angelos D. Keromytis},
title = {kGuard: Lightweight Kernel Protection against Return-to-user Attacks},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Return-to-user (ret2usr) attacks exploit the operating system kernel, enabling local users to hijack privileged execution paths and execute arbitrary code with elevated privileges. Current defenses have proven to be inadequate, as they have been repeatedly circumvented, incur considerable overhead, or rely on extended hypervisors and special hardware features. We present kGuard, a compiler plugin that augments the kernel with compact inline guards, which prevent ret2usr with low performance and space overhead. kGuard can be used with any operating system that features a weak separation between kernel and user space, requires no modifications to the OS, and is applicable to both 32- and 64-bit architectures. Our evaluation demonstrates that Linux kernels compiled with kGuard become impervious to a variety of control-flow hijacking exploits. kGuard exhibits lower overhead than previous work, imposing on average an overhead of 11.4 % on system call and I/O latency on x86 OSs, and 10.3 % on x86-64. The size of a kGuardprotected kernel grows between 3.5 % and 5.6%, due to the inserted checks, while the impact on real-life applications is minimal (≤1%). 1
Keyphrases
return-to-user attack lightweight kernel protection user space system call linux kernel x86 os low performance current defense kguardprotected kernel grows operating system kernel space overhead inserted check special hardware feature local user compiler plugin operating system previous work elevated privilege execute arbitrary code weak separation compact inline guard 64-bit architecture real-life application privileged execution path
