DMCA
KCoFI: Complete control-flow integrity for commodity operating system kernels (2014)
| Venue: | IEEE S&P |
| Citations: | 14 - 1 self |
BibTeX
@ARTICLE{Criswell14kcofi:complete,
author = {John Criswell and Nathan Dautenhahn and Vikram Adve},
title = {KCoFI: Complete control-flow integrity for commodity operating system kernels},
journal = {IEEE S&P},
year = {2014}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
We present a new system, KCoFI, that is the first we know of to provide complete Control-Flow Integrity protection for commodity operating systems without using heavyweight complete memory safety. Unlike previous systems, KCoFI protects commodity operating systems from classical control-flow hijack attacks, return-to-user attacks, and code segment modification attacks. We formally verify a subset of KCoFI’s design by modeling several features in small-step semantics and providing a partial proof that the semantics maintain control-flow integrity. The model and proof account for oper-ations such as page table management, trap handlers, context switching, and signal delivery. Our evaluation shows that KCoFI prevents all the gadgets found by an open-source Return Oriented Programming (ROP) gadget-finding tool in the FreeBSD kernel from being used; it also reduces the number of indirect control-flow targets by 98.18%. Our evaluation also shows that the performance impact of KCoFI on web server bandwidth is negligible while file transfer bandwidth using OpenSSH is reduced by an average of 13%, and at worst 27%, across a wide range of file sizes. PostMark, an extremely file-system intensive benchmark, shows 2x overhead. Where comparable numbers are available, the overheads of KCoFI are far lower than heavyweight memory-safety techniques. I.
Keyphrases
complete control-flow integrity commodity operating system kernel small-step semantics code segment modification attack classical control-flow hijack attack trap handler file size wide range signal delivery return-to-user attack open-source return oriented programming control-flow integrity partial proof heavyweight memory-safety technique new system file transfer bandwidth heavyweight complete memory safety complete control-flow integrity protection several feature context switching freebsd kernel gadget-finding tool web server bandwidth page table management file-system intensive benchmark indirect control-flow target proof account comparable number previous system performance impact
