Protecting Applications Against TOCTTOU Races by User-Space Caching - - PowerPoint PPT Presentation

▶
protecting applications against tocttou races by user
SMART_READER_LITE
LIVE PREVIEW

Protecting Applications Against TOCTTOU Races by User-Space Caching - - PowerPoint PPT Presentation

Feb 16, 2024 485 likes •832 views

DynaRace Protecting Applications Against TOCTTOU Races by User-Space Caching of File Metadata Mathias Payer & Thomas R. Gross Department of Computer Science ETH Zrich, Switzerland TOCTTOU races Time Of Check To Time of Use (TOCTTOU)

slide-1
SLIDE 1

DynaRace Protecting Applications Against TOCTTOU Races by User-Space Caching of File Metadata

Mathias Payer & Thomas R. Gross Department of Computer Science ETH Zürich, Switzerland

slide-2
SLIDE 2

2012-03-04 Mathias Payer, ETH Zürich 2

TOCTTOU races

Time Of Check To Time of Use (TOCTTOU) races for file accesses endanger integrity of applications

  • The mapping between filename and inode is volatile
  • Attacker uses delay between “test” and “use” system calls

SUID program access("file"); ... fd = open("file"); read(fd, ...); Race opportunity Attacker unlink("file"); link("sensitive", "file");

slide-3
SLIDE 3

2012-03-04 Mathias Payer, ETH Zürich 3

Motivation: Protect applications

Protect unmodified applications from TOCTTOU races Cache metadata for accessed files

  • Check and verify metadata on all file accesses
  • User-space implementation

Metadata cache links filenames and inodes

  • Stop potential file-based race attacks

Close the door to one popular attack vector

slide-4
SLIDE 4

2012-03-04 Mathias Payer, ETH Zürich 4

Outline

Motivation DynaRace key idea

  • File states capture permissions
  • File resolution ensures safety

Implementation Evaluation Related work Conclusion

slide-5
SLIDE 5

2012-03-04 Mathias Payer, ETH Zürich 5

DynaRace key idea

Application (plus libraries) Kernel System Calls

Keep state and metadata for all files

slide-6
SLIDE 6

2012-03-04 Mathias Payer, ETH Zürich 6

DynaRace key idea

Keep state and metadata for all files

  • Update metadata for new files
  • Enforce metadata equality for known files

Application (plus libraries) Kernel

DynaRace: metadata cache

File-based system calls Other system calls

slide-7
SLIDE 7

2012-03-04 Mathias Payer, ETH Zürich 7

DynaRace file states

DynaRace keeps state for each accessed file

new update enforce retire

slide-8
SLIDE 8

2012-03-04 Mathias Payer, ETH Zürich 8

DynaRace file states

State transitions according to system calls groups

new update enforce retire close

  • Test: check a property, e.g., access, or stat
  • Use: work with files, e.g., open, or chmod
  • Close: retire files, e.g., close, or unlink

test test test test use use use use &

slide-9
SLIDE 9

2012-03-04 Mathias Payer, ETH Zürich 9

DynaRace file states: Example

new update enforce retire use & test test use test use use close test SUID program access("file"); ... fd = open("file"); read(fd, ...); close(fd); update Metadata file cache: file in /tmp [update]

slide-10
SLIDE 10

2012-03-04 Mathias Payer, ETH Zürich 10

DynaRace file states: Example

new update enforce retire use & test test use test use use close test SUID program access("file"); ... fd = open("file"); read(fd, ...); close(fd); enforce Metadata file cache: file in /tmp [enforce]

slide-11
SLIDE 11

2012-03-04 Mathias Payer, ETH Zürich 11

DynaRace file states: Example

new update enforce retire use & test test use test use use close test SUID program access("file"); ... fd = open("file"); read(fd, ...); close(fd); retire Metadata file cache: file in /tmp [retire]

slide-12
SLIDE 12

2012-03-04 Mathias Payer, ETH Zürich 12

DynaRace file states: Example 2

new update enforce retire use & test test use test use use close test SUID program access("file"); ... fd = open("file"); read(fd, ...); close(fd); update Metadata file cache: empty Metadata file cache: file in /tmp [update]

slide-13
SLIDE 13

2012-03-04 Mathias Payer, ETH Zürich 13

DynaRace file states: Example 2

new update enforce retire use & test test use test use use close test SUID program access("file"); ... fd = open("file"); read(fd, ...); close(fd); update Metadata file cache: empty Metadata file cache: file in /tmp [update] Race

slide-14
SLIDE 14

2012-03-04 Mathias Payer, ETH Zürich 14

DynaRace file states: Example 2

new update enforce retire use & test test use test use use close test SUID program access("file"); ... fd = open("file"); read(fd, ...); close(fd); update enforce Metadata file cache: empty Metadata file cache: file in /tmp [update] Metadata file cache: file in /tmp [enforce] Race enforce

slide-15
SLIDE 15

2012-03-04 Mathias Payer, ETH Zürich 15

DynaRace file resolution

Resolve files in race-free manner*

  • Resolve the path atom by atom
  • Check if the atom is in the cache

–

Enforce metadata according to state

  • Update atom's metadata
  • Use recursion to follow links

* Files are resolved similar to the check_use mechanism by Tsafrir et al. [FAST'08, IBM TR RC24572]

Resolving /tmp/.X0-lock / tmp/ in / .X0-lock in /tmp/

slide-16
SLIDE 16

2012-03-04 Mathias Payer, ETH Zürich 16

Outline

Motivation The DynaRace approach Implementation Evaluation Related work Conclusion

slide-17
SLIDE 17

2012-03-04 Mathias Payer, ETH Zürich 17

DynaRace prototype implementation

Prototype implementation uses user-space virtualization

  • Additional virtualization layer between application and OS

Libdetox* rewrites executed application code

  • File-based system calls replaced with DynaRace functions
  • Metadata and state cache in VM layer
  • Linux x86 implementation

* Libdetox implements software-based fault isolation using dynamic BT by Payer et al. [VEE'11]

slide-18
SLIDE 18

2012-03-04 Mathias Payer, ETH Zürich 18

DynaRace prototype implementation

Libdetox

  • Total loc:

15'130

– Translation tables loc:

4'907

  • Comments:

5'015

DynaRace (for subset of system calls)

  • Total loc:

441

  • Comments:

372

  • Changes to libdetox per redirected system call: 2 loc
slide-19
SLIDE 19

2012-03-04 Mathias Payer, ETH Zürich 19

Outline

Motivation The DynaRace approach Implementation Evaluation

  • Apache performance
  • X.org bug study

Related work Conclusion

slide-20
SLIDE 20

2012-03-04 Mathias Payer, ETH Zürich 20

Apache performance

Apache 2.2 on Ubuntu 10.04 LTS using ab benchmark

  • Core i7 950 CPU @ 3.07GHz, in 32bit x86 mode
  • ab executes with two concurrent connections
  • Each file is downloaded 100,000 times

–

index.html 5kB HTML

–

image.png 1MB raw data

–

test.php short PHP script (90B output)

–

test2.php long PHP script (49kB output)

slide-21
SLIDE 21

2012-03-04 Mathias Payer, ETH Zürich 21

Apache performance

3 different configurations:

  • Native: native, unmodified execution of Apache
  • Libdetox: Apache running in Libdetox sandbox
  • DynaRace: Libdetox + DynaRace protection
slide-22
SLIDE 22

2012-03-04 Mathias Payer, ETH Zürich 22

Apache performance

index.html image.png test.php test2.php 0% 20% 40% 60% 80% 100% 120% 140%

native libdetox DynaRace Benchmark Relative performance

Overhead of DynaRace comparable to libdetox Speedup due to better code layout Overall performance penalty is tolerable

slide-23
SLIDE 23

2012-03-04 Mathias Payer, ETH Zürich 23

X.org security exploit

X.org protected with DynaRace

* in os/utils.c [CVE-2011-4029] ... lfd = open(tmp, O_CREAT|O_EXCL|O_WRONLY, 0644); ... if(lfd < 0) { unlink(tmp); } ... write(lfd, pid_str, 11); /* unchecked relaxation */ chmod(tmp, 0444); ... P1 tmp lock file: /tmp/.X0-lock P1 metadata file cache: .X0-lock in /tmp [enforce]

slide-24
SLIDE 24

2012-03-04 Mathias Payer, ETH Zürich 24

X.org security exploit

X.org protected with DynaRace

* in os/utils.c [CVE-2011-4029] ... lfd = open(tmp, O_CREAT|O_EXCL|O_WRONLY, 0644); ... if(lfd < 0) { unlink(tmp); } ... write(lfd, pid_str, 11); /* unchecked relaxation */ chmod(tmp, 0444); ... P1 zzz P2 tmp lock file: /tmp/.X0-lock P1 metadata file cache: .X0-lock in /tmp [enforce] P2 metadata file cache: .X0-lock in /tmp [enforce]

slide-25
SLIDE 25

2012-03-04 Mathias Payer, ETH Zürich 25

X.org security exploit

X.org protected with DynaRace

* in os/utils.c [CVE-2011-4029] ... lfd = open(tmp, O_CREAT|O_EXCL|O_WRONLY, 0644); ... if(lfd < 0) { unlink(tmp); } ... write(lfd, pid_str, 11); /* unchecked relaxation */ chmod(tmp, 0444); ... P1 zzz P x tmp lock file: /tmp/.X0-lock File removed by P2 P1 metadata file cache: .X0-lock in /tmp [enforce] P2 metadata file cache: .X0-lock in /tmp [retire]

slide-26
SLIDE 26

2012-03-04 Mathias Payer, ETH Zürich 26

X.org security exploit

X.org protected with DynaRace

* in os/utils.c [CVE-2011-4029] ... lfd = open(tmp, O_CREAT|O_EXCL|O_WRONLY, 0644); ... if(lfd < 0) { unlink(tmp); } ... write(lfd, pid_str, 11); /* unchecked relaxation */ chmod(tmp, 0444); ... P1 zzz Attacker links /tmp/.X0-lock to a sensitive file (e.g., /etc/shadow) P1 metadata file cache: .X0-lock in /tmp [enforce]

slide-27
SLIDE 27

2012-03-04 Mathias Payer, ETH Zürich 27

X.org security exploit

X.org protected with DynaRace

* in os/utils.c [CVE-2011-4029] ... lfd = open(tmp, O_CREAT|O_EXCL|O_WRONLY, 0644); ... if(lfd < 0) { unlink(tmp); } ... write(lfd, pid_str, 11); /* unchecked relaxation */ chmod(tmp, 0444); ... P1 tmp lock file: /tmp/.X0-lock links to /etc/shadow P1 metadata file cache: .X0-lock in /tmp [enforce] Metadata mismatch for .X0-lock P1 is terminated with race exception Attacker is not successful

slide-28
SLIDE 28

2012-03-04 Mathias Payer, ETH Zürich 28

Outline

Motivation The DynaRace approach Implementation Evaluation Related work Conclusion

slide-29
SLIDE 29

2012-03-04 Mathias Payer, ETH Zürich 29

Related work

Mazières and Kaashoek change OS to support inode-based file access [HotOS'97]

  • Implemented as new system calls

Tsafrir et al. implement safe user-space path resolution [FAST'08, IBM TR RC24572]

  • Safe path resolution needs program changes

Chari et al. ensure that given path elements are safe to

  • pen by the current user [NDSS'10]
  • Introduces manipulators as new concept, needs program changes

More related work in the paper

slide-30
SLIDE 30

2012-03-04 Mathias Payer, ETH Zürich 30

Conclusion

DynaRace protects unmodified applications from file- based TOCTTOU races

  • Files checked depending on state and metadata cache
  • Enforces metadata equality for currently used files

Binary translator rewrites unsafe system calls

  • User-space cache protects application

Removes the burden of race protection from the programmer

slide-31
SLIDE 31

2012-03-04 Mathias Payer, ETH Zürich 31

Thank you for your attention

?

slide-32
SLIDE 32

2012-03-04 Mathias Payer, ETH Zürich 32

Implementation alternatives

Kernel implementation

  • No BT overhead
  • Additional code & complexity in kernel

libc-based implementation

  • No BT overhead
  • Potential coverage problem

Ptrace-based implementation

  • Easy interception of system calls
  • Injecting code for DynaRace system call replacements is difficult
slide-33
SLIDE 33

2012-03-04 Mathias Payer, ETH Zürich 33

Apache performance

native* libdetox** DynaRace** index.html 1464

  • 14.5%
  • 9.4%

image.png 48

  • 6.3%

1.6% test.php 1773 11.9% 15.5% test2.php 463 25.9% 30.9% * requests per second ** relative overhead/speedup compared to native