Architectural Supports to Protect OS Kernels from Code-Injection Attacks and Their Applications

Authors:
Open Access
Publisher website
Google Scholar
Abstract
The kernel code injection is a common behavior of kernel-compromising attacks where the attackers aim to gain their goals by manipulating an OS kernel. Several security mechanisms have been proposed to mitigate such threats, but they all suffer from non-negligible performance overhead. This article introduces a hardware reference monitor, called Kargos, which can detect the kernel code injection attacks with nearly zero performance cost. Kargos monitors the behaviors of an OS kernel from outside the CPU through the standard bus interconnect and debug interface available with most major microprocessors. By watching the execution traces and memory access events in the monitored target system, Kargos uncovers attempts to execute malicious code with the kernel privilege. On top of this, we also applied the architectural supports for Kargos to the detection of ROP attacks. KS-Stack is the hardware component that builds and maintains the shadow stacks using the existing supports to detect this ROP attacks. According to our experiments, Kargos detected all the kernel code injection attacks that we tested, yet just increasing the computational loads on the target CPU by less than 1% on average. The performance overhead of the KS-Stack was also less than 1%.
Funding Information
  • Korea governmen (2014R1A2A1A10051792 and R0190-16-2010)
  • National Research Foundation of Kore
  • Institute for Information 8 communications Technology Promotio
  • Development on the SW/HW modules of Processor Monitor for System Intrusion Detection) (2016-0-00078)
  • MSIP(Ministry of Science, ICT and Future Planning), Korea
  • Cloud based Security Intelligence Technology Development for the Customized Security Service Provisioning
  • IIT
  • ITR (IITP-2017-2015-0-00403)