A kernel stack protection model against attacks from kernel execution units

Abstract Many defensive approaches have been proposed to protect the integrity of the operating system kernel stack. However, some types of attacks, such as the “return-to-schedule” rootkit, pose a serious threat to these approaches. In this paper, we present a kernel stack protection model to protect the integrity of the kernel stack. It adopts a synchronous design strategy to bind the execution unit with its kernel stack using virtualization technology, and allows the execution unit to write its own current kernel stack with legal kernel codes. To test the model, we propose three kinds of potential attacks which extend the “return-to-schedule” rootkit. The experimental results show that the prototype of the model can be effective against all attack methods, and introduces a performance cost of only 2%. Therefore, it effectively protects all types of data on the kernel stack with a small performance overhead.

[1]  Hovav Shacham,et al.  The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86) , 2007, CCS '07.

[2]  Xuxian Jiang,et al.  Defeating Dynamic Data Kernel Rootkit Attacks via VMM-Based Guest-Transparent Monitoring , 2009, 2009 International Conference on Availability, Reliability and Security.

[3]  Radu Sion,et al.  SoK: Introspections on Trust and the Semantic Gap , 2014, 2014 IEEE Symposium on Security and Privacy.

[4]  Ying Wang,et al.  VMDetector: A VMM-based Platform to Detect Hidden Process by Multi-view Comparison , 2011, 2011 IEEE 13th International Symposium on High-Assurance Systems Engineering.

[5]  Wenke Lee,et al.  Secure in-VM monitoring using hardware virtualization , 2009, CCS.

[6]  Changzhen Hu,et al.  Defeating buffer overflow attacks via virtualization , 2014, Comput. Electr. Eng..

[7]  Kevin W. Hamlen,et al.  Binary stirring: self-randomizing instruction addresses of legacy x86 binary code , 2012, CCS.

[8]  Wenke Lee,et al.  Lares: An Architecture for Secure Active Monitoring Using Virtualization , 2008, 2008 IEEE Symposium on Security and Privacy (sp 2008).

[9]  Adrian Perrig,et al.  SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes , 2007, SOSP.

[10]  Yuan Luo,et al.  A stack-based lightweight approach to detect kernel-level rookits , 2015, 2015 IEEE International Conference on Progress in Informatics and Computing (PIC).

[11]  Bill Blunden.  The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System , 2009 .

[12]  Emmett Witchel,et al.  Ensuring operating system kernel integrity with OSck , 2011, ASPLOS XVI.

[13]  Xuxian Jiang,et al.  Countering kernel rootkits with lightweight hook protection , 2009, CCS.

[14]  Zhi Wang,et al.  Defeating return-oriented rootkits with "Return-Less" kernels , 2010, EuroSys '10.

[15]  Leyla Bilge,et al.  G-Free: defeating return-oriented programming through gadget-less binaries , 2010, ACSAC '10.

[16]  Debin Gao,et al.  Launching Return-Oriented Programming Attacks against Randomized Relocatable Executables , 2011, 2011IEEE 10th International Conference on Trust, Security and Privacy in Computing and Communications.