Security Bugs in Embedded Interpreters Haogang Chen, Cody Cutler, - - PowerPoint PPT Presentation

▶
security bugs in embedded interpreters
SMART_READER_LITE
LIVE PREVIEW

Security Bugs in Embedded Interpreters Haogang Chen, Cody Cutler, - - PowerPoint PPT Presentation

Mar 17, 2023 441 likes •1.39k views

Security Bugs in Embedded Interpreters Haogang Chen, Cody Cutler, Taesoo Kim, Yandong Mao, Xi Wang, Nickolai Zeldovich and M. Frans Kaashoek MIT CSAIL Embedded interpreters Host system Bytecode Embedded Output interpreter Input

slide-1
SLIDE 1

Security Bugs in Embedded Interpreters

Haogang Chen, Cody Cutler, Taesoo Kim, Yandong Mao, Xi Wang, Nickolai Zeldovich and M. Frans Kaashoek MIT CSAIL

slide-2
SLIDE 2

Embedded interpreters

Host system Embedded interpreter Bytecode Input Output

slide-3
SLIDE 3

Embedded interpreters

Host system Embedded interpreter Bytecode Input Output

  • Define an instruction set in the form of bytecode
slide-4
SLIDE 4

Embedded interpreters

Host system Embedded interpreter Bytecode Input Output

  • Define an instruction set in the form of bytecode
  • Interpret and execute bytecode on a virtual machine
slide-5
SLIDE 5

Embedded interpreters

Host system Embedded interpreter Bytecode Input Output

  • Define an instruction set in the form of bytecode
  • Interpret and execute bytecode on a virtual machine
  • Usually light-weight, and no process-level sandboxing
slide-6
SLIDE 6

Prevalence of embedded interpreters and related vulnerabilities

slide-7
SLIDE 7

Prevalence of embedded interpreters and related vulnerabilities

Software Interpreter Known vulnerabilities

slide-8
SLIDE 8

Prevalence of embedded interpreters and related vulnerabilities

Software Interpreter Known vulnerabilities

BPF CVE-2010-4158 CVE-2012-3729 INET_DIAG CVE-2010-3880 CVE-2011-2213 AML CVE-2010-4347 CVE-2011-1021

slide-9
SLIDE 9

Prevalence of embedded interpreters and related vulnerabilities

Software Interpreter Known vulnerabilities

BPF CVE-2010-4158 CVE-2012-3729 INET_DIAG CVE-2010-3880 CVE-2011-2213 AML CVE-2010-4347 CVE-2011-1021 RarVM CVE-2007-3725 LLVM CVE-2011-3627

slide-10
SLIDE 10

Prevalence of embedded interpreters and related vulnerabilities

Software Interpreter Known vulnerabilities

BPF CVE-2010-4158 CVE-2012-3729 INET_DIAG CVE-2010-3880 CVE-2011-2213 AML CVE-2010-4347 CVE-2011-1021 RarVM CVE-2007-3725 LLVM CVE-2011-3627 Bitcoin bitcoin CVE-2010-5137

slide-11
SLIDE 11

Prevalence of embedded interpreters and related vulnerabilities

Software Interpreter Known vulnerabilities

BPF CVE-2010-4158 CVE-2012-3729 INET_DIAG CVE-2010-3880 CVE-2011-2213 AML CVE-2010-4347 CVE-2011-1021 RarVM CVE-2007-3725 LLVM CVE-2011-3627 Bitcoin bitcoin CVE-2010-5137 Python Pickle CVE-2011-2520 CVE-2012-4406

slide-12
SLIDE 12

Prevalence of embedded interpreters and related vulnerabilities

Software Interpreter Known vulnerabilities

BPF CVE-2010-4158 CVE-2012-3729 INET_DIAG CVE-2010-3880 CVE-2011-2213 AML CVE-2010-4347 CVE-2011-1021 RarVM CVE-2007-3725 LLVM CVE-2011-3627 Bitcoin bitcoin CVE-2010-5137 Python Pickle CVE-2011-2520 CVE-2012-4406 FreeType TrueType / Type 1 Charstring CVE-2010-2520 CVE-2011-0226

slide-13
SLIDE 13

Prevalence of embedded interpreters and related vulnerabilities

Software Interpreter Known vulnerabilities

BPF CVE-2010-4158 CVE-2012-3729 INET_DIAG CVE-2010-3880 CVE-2011-2213 AML CVE-2010-4347 CVE-2011-1021 RarVM CVE-2007-3725 LLVM CVE-2011-3627 Bitcoin bitcoin CVE-2010-5137 Python Pickle CVE-2011-2520 CVE-2012-4406 FreeType TrueType / Type 1 Charstring CVE-2010-2520 CVE-2011-0226

slide-14
SLIDE 14

Prevalence of embedded interpreters and related vulnerabilities

Software Interpreter Known vulnerabilities

BPF CVE-2010-4158 CVE-2012-3729 INET_DIAG CVE-2010-3880 CVE-2011-2213 AML CVE-2010-4347 CVE-2011-1021 RarVM CVE-2007-3725 LLVM CVE-2011-3627 Bitcoin bitcoin CVE-2010-5137 Python Pickle CVE-2011-2520 CVE-2012-4406 FreeType TrueType / Type 1 Charstring CVE-2010-2520 CVE-2011-0226

slide-15
SLIDE 15

Our contributions

  • Studies of 10 widely-used embedded

interpreters in real world

  • Studies of known vulnerabilities
  • Security guidelines
  • Research opportunities
slide-16
SLIDE 16

Why do people use embedded interpreter?

slide-17
SLIDE 17

A packet filtering example

$"tcpdump"‘ip"src"net"not"(18.26.5.0/24"or"18.1.2.0/24)’

  • Monitor all packets that do not originate

from 18.26.5.* or 18.1.2.*

slide-18
SLIDE 18

A packet filtering example

  • Strawman 1: user space filtering
  • The kernel passes all packets to tcpdump

$"tcpdump"‘ip"src"net"not"(18.26.5.0/24"or"18.1.2.0/24)’

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump

kernel

**** * * * **** * * * packets filtered packets

  • Monitor all packets that do not originate

from 18.26.5.* or 18.1.2.*

slide-19
SLIDE 19

A packet filtering example

  • Strawman 1: user space filtering
  • The kernel passes all packets to tcpdump
  • ✔ Flexibility ✔ Security ✘ Performance

$"tcpdump"‘ip"src"net"not"(18.26.5.0/24"or"18.1.2.0/24)’

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump

kernel

**** * * * **** * * * packets filtered packets

  • Monitor all packets that do not originate

from 18.26.5.* or 18.1.2.*

slide-20
SLIDE 20

A packet filtering example

slide-21
SLIDE 21

A packet filtering example

  • Strawman II: extensible kernel module
slide-22
SLIDE 22

A packet filtering example

  • Strawman II: extensible kernel module
  • tcpdump uploads compiled native code to the kernel

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump Kernel module

ld*****12(%ebx),*%eax* test***%eax,*$0x800 jeq****L3 ld*****26(%ebx),*%eax and****%eax,*$0xffffff00 ********...

**** * * * **** * * * packets filtered packets

kernel

Native code

slide-23
SLIDE 23

A packet filtering example

  • Strawman II: extensible kernel module
  • tcpdump uploads compiled native code to the kernel
  • ✔ Flexibility ✔ Performance ✘ Security

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump Kernel module

ld*****12(%ebx),*%eax* test***%eax,*$0x800 jeq****L3 ld*****26(%ebx),*%eax and****%eax,*$0xffffff00 ********...

**** * * * **** * * * packets filtered packets

kernel

Native code

slide-24
SLIDE 24

Solution: Berkeley Packet Filter (BPF)

slide-25
SLIDE 25

Solution: Berkeley Packet Filter (BPF)

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump

slide-26
SLIDE 26

Solution: Berkeley Packet Filter (BPF)

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program

slide-27
SLIDE 27

Solution: Berkeley Packet Filter (BPF)

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program

kernel

Host system

slide-28
SLIDE 28

Solution: Berkeley Packet Filter (BPF)

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program

kernel

Host system

slide-29
SLIDE 29

Solution: Berkeley Packet Filter (BPF)

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode

kernel

Host system

slide-30
SLIDE 30

Solution: Berkeley Packet Filter (BPF)

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode Filtered packets

kernel

Host system

slide-31
SLIDE 31

Solution: Berkeley Packet Filter (BPF)

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode Filtered packets

kernel

Host system

✔ Flexibility

slide-32
SLIDE 32

Solution: Berkeley Packet Filter (BPF)

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode Filtered packets

kernel

Host system

✔ Flexibility ✔ Performance —— no IPC & context switch overhead

slide-33
SLIDE 33

Solution: Berkeley Packet Filter (BPF)

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode Filtered packets

kernel

Host system

✔ Flexibility ✔ Performance —— no IPC & context switch overhead ✔ “Security” —— no direct control of the real machine

slide-34
SLIDE 34

Solution: Berkeley Packet Filter (BPF)

Are embedded interpreters really secure?

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode Filtered packets

kernel

Host system

slide-35
SLIDE 35

Solution: Berkeley Packet Filter (BPF)

Are embedded interpreters really secure?

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode Filtered packets

kernel

Host system

Untrusted bytecode

********!@#S****[238472398] *********$&$s****#934dead L1:*****@#&#$(&@#$*#@$ ********kill****[xxx] ********#@!&#*@#**!*&#$*$*# L2:*****... ********ret*****#deadbeaf *********#(@&*&*$#!@&(&

Bytecode program

slide-36
SLIDE 36

Solution: Berkeley Packet Filter (BPF)

Are embedded interpreters really secure?

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode Filtered packets

kernel

Host system **** * * * **** * * * packets Inputs to bytecode

Untrusted input Untrusted bytecode

********!@#S****[238472398] *********$&$s****#934dead L1:*****@#&#$(&@#$*#@$ ********kill****[xxx] ********#@!&#*@#**!*&#$*$*# L2:*****... ********ret*****#deadbeaf *********#(@&*&*$#!@&(&

Bytecode program

slide-37
SLIDE 37

Solution: Berkeley Packet Filter (BPF)

Are embedded interpreters really secure?

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode Filtered packets

kernel

Host system **** * * * **** * * * packets Inputs to bytecode

Untrusted input Untrusted bytecode

********!@#S****[238472398] *********$&$s****#934dead L1:*****@#&#$(&@#$*#@$ ********kill****[xxx] ********#@!&#*@#**!*&#$*$*# L2:*****... ********ret*****#deadbeaf *********#(@&*&*$#!@&(&

Bytecode program

slide-38
SLIDE 38

Solution: Berkeley Packet Filter (BPF)

Are embedded interpreters really secure?

ip*src*net*not* (18.26.5.0/24*or*18.0.0.0/24)

tcpdump BPF interpreter

********ldh****[12] ********jeq****#ETHERTYPE_IP,*L1,*L4 L1:*****ld*****[26] ********and****#0xffffff00 ********jeq****#0x121a0500,*L4,*L2 L2:*****jeq****#0x12010200,*L4,*L3 L3:*****ret****#TRUE L4:*****ret****#0

Bytecode program **** * * * **** * * * packets Inputs to bytecode Filtered packets

kernel

Host system **** * * * **** * * * packets Inputs to bytecode

Untrusted input Untrusted bytecode

********!@#S****[238472398] *********$&$s****#934dead L1:*****@#&#$(&@#$*#@$ ********kill****[xxx] ********#@!&#*@#**!*&#$*$*# L2:*****... ********ret*****#deadbeaf *********#(@&*&*$#!@&(&

Bytecode program

slide-39
SLIDE 39

Security of embedded interpreters

slide-40
SLIDE 40

Security of embedded interpreters

  • Untrusted bytecode
  • Must validate the bytecode before execution
slide-41
SLIDE 41

Security of embedded interpreters

  • Untrusted bytecode
  • Must validate the bytecode before execution
  • Untrusted input
  • Must execute the bytecode defensively
slide-42
SLIDE 42

Security of embedded interpreters

  • Untrusted bytecode
  • Must validate the bytecode before execution
  • Untrusted input
  • Must execute the bytecode defensively
  • No strict isolation
  • Must prevent bugs in embedded interpreters from

affecting the host system

slide-43
SLIDE 43

Security of embedded interpreters

  • Untrusted bytecode
  • Must validate the bytecode before execution
  • Untrusted input
  • Must execute the bytecode defensively
  • No strict isolation
  • Must prevent bugs in embedded interpreters from

affecting the host system

  • Embedded interpreters that fail to do so

(correctly) will be vulnerable

slide-44
SLIDE 44

Vulnerability case studies

  • Untrusted bytecode
  • INET_DIAG infinite loop vulnerability

(CVE-2011-2213)

  • Untrusted input
  • ClamAV signed division vulnerability
  • No strict isolation
  • FreeType arbitrary code execution vulnerability

(CVE-2011-0226)

slide-45
SLIDE 45

INET DIAG infinite loop vulnerability

slide-46
SLIDE 46

INET DIAG infinite loop vulnerability

$*ss*‘...’

slide-47
SLIDE 47

INET DIAG infinite loop vulnerability

"""""sge""""21,"L1,"rej""";"02"04"... L1:""sge""1024,"L2,"acc""";"02"04"... L2:""jmp""rej""""""""""""";"01"04"... acc:"nop"""""""""""""""""";"00"04 rej:

Userspace filter code

$*ss*‘...’

slide-48
SLIDE 48

INET DIAG infinite loop vulnerability

suspicious files suspicious files Socket state (trusted)

"""""sge""""21,"L1,"rej""";"02"04"... L1:""sge""1024,"L2,"acc""";"02"04"... L2:""jmp""rej""""""""""""";"01"04"... acc:"nop"""""""""""""""""";"00"04 rej:

Userspace filter code

$*ss*‘...’

slide-49
SLIDE 49

struct"inet_diag_bc_op"{"""""//"instruction"header """"unsigned"char"""opcode;""//"opcode """"unsigned"char"""oplen;"""//"instruction"length };

INET DIAG infinite loop vulnerability

suspicious files suspicious files Socket state (trusted)

"""""sge""""21,"L1,"rej""";"02"04"... L1:""sge""1024,"L2,"acc""";"02"04"... L2:""jmp""rej""""""""""""";"01"04"... acc:"nop"""""""""""""""""";"00"04 rej:

Userspace filter code

$*ss*‘...’

slide-50
SLIDE 50

struct"inet_diag_bc_op"{"""""//"instruction"header """"unsigned"char"""opcode;""//"opcode """"unsigned"char"""oplen;"""//"instruction"length };

INET DIAG infinite loop vulnerability

suspicious files suspicious files Socket state (trusted)

"""""sge""""21,"L1,"rej""";"02"04"... L1:""sge""1024,"L2,"acc""";"02"04"... L2:""jmp""rej""""""""""""";"01"04"... acc:"nop"""""""""""""""""";"00"04 rej:

Userspace filter code

$*ss*‘...’

slide-51
SLIDE 51

struct"inet_diag_bc_op"{"""""//"instruction"header """"unsigned"char"""opcode;""//"opcode """"unsigned"char"""oplen;"""//"instruction"length };

INET DIAG infinite loop vulnerability

suspicious files suspicious files Socket state (trusted)

"""""sge""""21,"L1,"rej""";"02"04"... L1:""sge""1024,"L2,"acc""";"02"04"... L2:""jmp""rej""""""""""""";"01"04"... acc:"nop"""""""""""""""""";"00"04 rej:

Userspace filter code

$*ss*‘...’

//"validate"bytecode const"void"*bc"="bytecode; while"(len">"0)"{ """"struct"inet_diag_bc_op"*op"="bc; """"... """"bc"+="opP>oplen; """"len"P="opP>oplen; }

slide-52
SLIDE 52

struct"inet_diag_bc_op"{"""""//"instruction"header """"unsigned"char"""opcode;""//"opcode """"unsigned"char"""oplen;"""//"instruction"length };

INET DIAG infinite loop vulnerability

suspicious files suspicious files Socket state (trusted)

"""""sge""""21,"L1,"rej""";"02"04"... L1:""sge""1024,"L2,"acc""";"02"04"... L2:""jmp""rej""""""""""""";"01"04"... acc:"nop"""""""""""""""""";"00"04 rej:

Userspace filter code

Infinite loop when

  • p^>oplen is zero

$*ss*‘...’ 02"00 02"00 01"00 00"00

//"validate"bytecode const"void"*bc"="bytecode; while"(len">"0)"{ """"struct"inet_diag_bc_op"*op"="bc; """"... """"bc"+="opP>oplen; """"len"P="opP>oplen; }

slide-53
SLIDE 53

struct"inet_diag_bc_op"{"""""//"instruction"header """"unsigned"char"""opcode;""//"opcode """"unsigned"char"""oplen;"""//"instruction"length };

INET DIAG infinite loop vulnerability

suspicious files suspicious files Socket state (trusted)

"""""sge""""21,"L1,"rej""";"02"04"... L1:""sge""1024,"L2,"acc""";"02"04"... L2:""jmp""rej""""""""""""";"01"04"... acc:"nop"""""""""""""""""";"00"04 rej:

Userspace filter code

Infinite loop when

  • p^>oplen is zero

$*ss*‘...’ 02"00 02"00 01"00 00"00

//"validate"bytecode const"void"*bc"="bytecode; while"(len">"0)"{ """"struct"inet_diag_bc_op"*op"="bc; """"... """"bc"+="opP>oplen; """"len"P="opP>oplen; }

slide-54
SLIDE 54

struct"inet_diag_bc_op"{"""""//"instruction"header """"unsigned"char"""opcode;""//"opcode """"unsigned"char"""oplen;"""//"instruction"length };

INET DIAG infinite loop vulnerability

suspicious files suspicious files Socket state (trusted)

"""""sge""""21,"L1,"rej""";"02"04"... L1:""sge""1024,"L2,"acc""";"02"04"... L2:""jmp""rej""""""""""""";"01"04"... acc:"nop"""""""""""""""""";"00"04 rej:

Userspace filter code

+"""if"(opP>oplen"<"min_len)"//"min_len"is"at"least"4 +"""""""return"PEINVAL;

Infinite loop when

  • p^>oplen is zero

$*ss*‘...’ 02"00 02"00 01"00 00"00

//"validate"bytecode const"void"*bc"="bytecode; while"(len">"0)"{ """"struct"inet_diag_bc_op"*op"="bc; """"... """"bc"+="opP>oplen; """"len"P="opP>oplen; }

slide-55
SLIDE 55

Vulnerability case studies

  • Untrusted bytecode
  • INET_DIAG infinite loop vulnerability

(CVE-2011-2213)

  • Untrusted input
  • ClamAV signed division vulnerability
  • No strict isolation
  • FreeType arbitrary code execution vulnerability

(CVE-2011-0226)

slide-56
SLIDE 56

ClamAV signed division vulnerability

slide-57
SLIDE 57

ClamAV signed division vulnerability

%a"="load"i64*"inttoptr"i64"0"to"i64* %b"="load"i64*"inttoptr"i64"8"to"i64* %r"="sdiv"i64"%a,"%b ...

Bytecode signature

Cloud

slide-58
SLIDE 58

ClamAV signed division vulnerability

10000000"00000000 11111111"11111111 ..."...

suspicious files suspicious files Suspicious local file

%a"="load"i64*"inttoptr"i64"0"to"i64* %b"="load"i64*"inttoptr"i64"8"to"i64* %r"="sdiv"i64"%a,"%b ...

Bytecode signature

Cloud

slide-59
SLIDE 59

switch"(opcode)"{ .... case"OP_SDIV: { """"int64_t"a"="BINOPS(0);"//"dividend """"int64_t"b"="BINOPS(1);"//"divisor """"if"(b"=="0"||"(a"=="P1"&&"b"=="INT64_MIN)) """"""""return"CL_EBYTECODE; """"valueP>v"="a"/"b; } }

Interpreter code

ClamAV signed division vulnerability

10000000"00000000 11111111"11111111 ..."...

suspicious files suspicious files Suspicious local file

%a"="load"i64*"inttoptr"i64"0"to"i64* %b"="load"i64*"inttoptr"i64"8"to"i64* %r"="sdiv"i64"%a,"%b ...

Bytecode signature

Cloud

slide-60
SLIDE 60

switch"(opcode)"{ .... case"OP_SDIV: { """"int64_t"a"="BINOPS(0);"//"dividend """"int64_t"b"="BINOPS(1);"//"divisor """"if"(b"=="0"||"(a"=="P1"&&"b"=="INT64_MIN)) """"""""return"CL_EBYTECODE; """"valueP>v"="a"/"b; } }

Interpreter code

ClamAV signed division vulnerability

10000000"00000000 11111111"11111111 ..."...

suspicious files suspicious files Suspicious local file

%a"="load"i64*"inttoptr"i64"0"to"i64* %b"="load"i64*"inttoptr"i64"8"to"i64* %r"="sdiv"i64"%a,"%b ...

Bytecode signature

Cloud

slide-61
SLIDE 61

switch"(opcode)"{ .... case"OP_SDIV: { """"int64_t"a"="BINOPS(0);"//"dividend """"int64_t"b"="BINOPS(1);"//"divisor """"if"(b"=="0"||"(a"=="P1"&&"b"=="INT64_MIN)) """"""""return"CL_EBYTECODE; """"valueP>v"="a"/"b; } }

Interpreter code

ClamAV signed division vulnerability

10000000"00000000 11111111"11111111 ..."...

suspicious files suspicious files Suspicious local file

%a"="load"i64*"inttoptr"i64"0"to"i64* %b"="load"i64*"inttoptr"i64"8"to"i64* %r"="sdiv"i64"%a,"%b ...

Bytecode signature

Might trap on a/0 and INT64_MIN*/*^1

Cloud

slide-62
SLIDE 62

switch"(opcode)"{ .... case"OP_SDIV: { """"int64_t"a"="BINOPS(0);"//"dividend """"int64_t"b"="BINOPS(1);"//"divisor """"if"(b"=="0"||"(a"=="P1"&&"b"=="INT64_MIN)) """"""""return"CL_EBYTECODE; """"valueP>v"="a"/"b; } }

Interpreter code

ClamAV signed division vulnerability

10000000"00000000 11111111"11111111 ..."...

suspicious files suspicious files Suspicious local file

%a"="load"i64*"inttoptr"i64"0"to"i64* %b"="load"i64*"inttoptr"i64"8"to"i64* %r"="sdiv"i64"%a,"%b ...

Bytecode signature

Might trap on a/0 and INT64_MIN*/*^1 WRONG! Should swap a and b

Cloud

slide-63
SLIDE 63

Vulnerability case studies

  • Untrusted bytecode
  • INET_DIAG infinite loop vulnerability

(CVE-2011-2213)

  • Untrusted input
  • ClamAV signed division vulnerability
  • No strict isolation
  • FreeType arbitrary code execution vulnerability

(CVE-2011-0226)

slide-64
SLIDE 64

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

slide-65
SLIDE 65

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

push"0xfea50000"""";"nargs"="P347 push"0x2a"""""""""";"subroutine"num"="42 callothersubr"""""";"call"custom"function ..."...

Malicious PDF file with embedded T1 font

slide-66
SLIDE 66

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

push"0xfea50000"""";"nargs"="P347 push"0x2a"""""""""";"subroutine"num"="42 callothersubr"""""";"call"custom"function ..."...

Malicious PDF file with embedded T1 font

slide-67
SLIDE 67

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

struct"T1_DecoderRec"{""""""""""""""//"T1"VM"state """"FT_Long"""stack[MAX_OPERANDS];""//"execution"stack """"FT_Long*""top;""""""""""""""""""//"stack"pointer """".... """"T1_Decoder_Callback"""parse_callback;"//"func"pointer };

push"0xfea50000"""";"nargs"="P347 push"0x2a"""""""""";"subroutine"num"="42 callothersubr"""""";"call"custom"function ..."...

Malicious PDF file with embedded T1 font

slide-68
SLIDE 68

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

struct"T1_DecoderRec"{""""""""""""""//"T1"VM"state """"FT_Long"""stack[MAX_OPERANDS];""//"execution"stack """"FT_Long*""top;""""""""""""""""""//"stack"pointer """".... """"T1_Decoder_Callback"""parse_callback;"//"func"pointer };

push"0xfea50000"""";"nargs"="P347 push"0x2a"""""""""";"subroutine"num"="42 callothersubr"""""";"call"custom"function ..."...

Malicious PDF file with embedded T1 font

slide-69
SLIDE 69

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

struct"T1_DecoderRec"{""""""""""""""//"T1"VM"state """"FT_Long"""stack[MAX_OPERANDS];""//"execution"stack """"FT_Long*""top;""""""""""""""""""//"stack"pointer """".... """"T1_Decoder_Callback"""parse_callback;"//"func"pointer };

push"0xfea50000"""";"nargs"="P347 push"0x2a"""""""""";"subroutine"num"="42 callothersubr"""""";"call"custom"function ..."...

Malicious PDF file with embedded T1 font

slide-70
SLIDE 70

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

struct"T1_DecoderRec"{""""""""""""""//"T1"VM"state """"FT_Long"""stack[MAX_OPERANDS];""//"execution"stack """"FT_Long*""top;""""""""""""""""""//"stack"pointer """".... """"T1_Decoder_Callback"""parse_callback;"//"func"pointer };

push"0xfea50000"""";"nargs"="P347 push"0x2a"""""""""";"subroutine"num"="42 callothersubr"""""";"call"custom"function ..."...

Malicious PDF file with embedded T1 font

//"execute"callothersubr case"CALL_OTHER_SUBR: """"//"dispatch"and"call"subroutines """"... """"//"pop"out"arguments"from"the"stack """"decoderP>top"P="nargs;

slide-71
SLIDE 71

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

struct"T1_DecoderRec"{""""""""""""""//"T1"VM"state """"FT_Long"""stack[MAX_OPERANDS];""//"execution"stack """"FT_Long*""top;""""""""""""""""""//"stack"pointer """".... """"T1_Decoder_Callback"""parse_callback;"//"func"pointer };

Did not validate nargs is in range

push"0xfea50000"""";"nargs"="P347 push"0x2a"""""""""";"subroutine"num"="42 callothersubr"""""";"call"custom"function ..."...

Malicious PDF file with embedded T1 font

//"execute"callothersubr case"CALL_OTHER_SUBR: """"//"dispatch"and"call"subroutines """"... """"//"pop"out"arguments"from"the"stack """"decoderP>top"P="nargs;

slide-72
SLIDE 72

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

struct"T1_DecoderRec"{""""""""""""""//"T1"VM"state """"FT_Long"""stack[MAX_OPERANDS];""//"execution"stack """"FT_Long*""top;""""""""""""""""""//"stack"pointer """".... """"T1_Decoder_Callback"""parse_callback;"//"func"pointer };

Did not validate nargs is in range

push"0xfea50000"""";"nargs"="P347 push"0x2a"""""""""";"subroutine"num"="42 callothersubr"""""";"call"custom"function ..."...

Malicious PDF file with embedded T1 font

//"execute"callothersubr case"CALL_OTHER_SUBR: """"//"dispatch"and"call"subroutines """"... """"//"pop"out"arguments"from"the"stack """"decoderP>top"P="nargs;

slide-73
SLIDE 73

J a i l b r e a k M e

CVE-2011-0226

FreeType arbitrary code execution

struct"T1_DecoderRec"{""""""""""""""//"T1"VM"state """"FT_Long"""stack[MAX_OPERANDS];""//"execution"stack """"FT_Long*""top;""""""""""""""""""//"stack"pointer """".... """"T1_Decoder_Callback"""parse_callback;"//"func"pointer };

Did not validate nargs is in range Overwrite function pointer

push"0xfea50000"""";"nargs"="P347 push"0x2a"""""""""";"subroutine"num"="42 callothersubr"""""";"call"custom"function ..."...

Malicious PDF file with embedded T1 font

//"execute"callothersubr case"CALL_OTHER_SUBR: """"//"dispatch"and"call"subroutines """"... """"//"pop"out"arguments"from"the"stack """"decoderP>top"P="nargs;

slide-74
SLIDE 74

Security guidelines

slide-75
SLIDE 75

Security guidelines

  • A better solution: process isolation
  • Running interpreter in a separate OS process
  • Can prevent bugs in the interpreter from affecting the

host system

  • Example: Chrome browser
slide-76
SLIDE 76

Security guidelines

  • A better solution: process isolation
  • Running interpreter in a separate OS process
  • Can prevent bugs in the interpreter from affecting the

host system

  • Example: Chrome browser
  • Exceptions
  • Application requires extreme performance
  • No processes (e.g. OS kernels)
slide-77
SLIDE 77

Pitfall 1: complex feature sets

slide-78
SLIDE 78

Pitfall 1: complex feature sets

  • Feature vs. vulnerability checklist
  • The more expressive a bytecode is, the wider range of

attack vectors there could be

slide-79
SLIDE 79

Pitfall 1: complex feature sets

  • Feature vs. vulnerability checklist
  • The more expressive a bytecode is, the wider range of

attack vectors there could be

Feature set Potential attack vectors

Arithmetic operations Div-by-zero, integer overflow Loops (backward jumps) Infinite loops, DoS Function calls Infinite recursion, stack overflow External calls to the host Arbitrary code execution Register file or scratch memory Information leak

slide-80
SLIDE 80

Pitfall 1: complex feature sets

  • Feature vs. vulnerability checklist
  • The more expressive a bytecode is, the wider range of

attack vectors there could be

  • Advices
  • Do not over-design
  • Example: bitcoin disabled many unused opcodes

Feature set Potential attack vectors

Arithmetic operations Div-by-zero, integer overflow Loops (backward jumps) Infinite loops, DoS Function calls Infinite recursion, stack overflow External calls to the host Arbitrary code execution Register file or scratch memory Information leak

slide-81
SLIDE 81

Pitfall 2: resource consumption

slide-82
SLIDE 82

Pitfall 2: resource consumption

  • Unconstrained resource consumption can

cause DoS attack to the host system

slide-83
SLIDE 83

Pitfall 2: resource consumption

  • Unconstrained resource consumption can

cause DoS attack to the host system

  • Advices
  • Limit execution time or total number of instructions
  • Limit stack growth and depth of nested calls
  • Terminate the bytecode and reclaim resources when

necessary

slide-84
SLIDE 84

Pitfall 3: calls to the host system

  • Allowing calling external functions from the

bytecode is a bad idea

  • Break interpreter / host isolation
  • Easily leads to arbitrary code execution
  • Examples: python’s pickle library
slide-85
SLIDE 85

Pitfall 3: calls to the host system

  • Allowing calling external functions from the

bytecode is a bad idea

  • Break interpreter / host isolation
  • Easily leads to arbitrary code execution
  • Examples: python’s pickle library
  • Advices
  • Need a clean and explicit interface
  • Ideally, all interaction with external world should be

limit to input and output

slide-86
SLIDE 86

Research Opportunities

slide-87
SLIDE 87

Research Opportunities

  • Testing embedded interpreters
slide-88
SLIDE 88

Research Opportunities

  • Testing embedded interpreters
  • Static analysis (or formal verification)
  • Challenge: many invariants are dynamic and complicated
slide-89
SLIDE 89

Research Opportunities

  • Testing embedded interpreters
  • Static analysis (or formal verification)
  • Challenge: many invariants are dynamic and complicated
  • Symbolic testing
  • Challenge: control flow highly depends on the bytecode
slide-90
SLIDE 90

Research Opportunities

  • Testing embedded interpreters
  • Static analysis (or formal verification)
  • Challenge: many invariants are dynamic and complicated
  • Symbolic testing
  • Challenge: control flow highly depends on the bytecode
  • Building reusable embedded interpreter

Embedded interpreter General-purpose bytecode (e.g. Java)

?

slide-91
SLIDE 91

Research Opportunities

  • Testing embedded interpreters
  • Static analysis (or formal verification)
  • Challenge: many invariants are dynamic and complicated
  • Symbolic testing
  • Challenge: control flow highly depends on the bytecode
  • Building reusable embedded interpreter
  • Challenge: trade-off between complexity and generality

Embedded interpreter General-purpose bytecode (e.g. Java)

?

  • Size of runtime
  • Performance
  • Portability
slide-92
SLIDE 92

References

  • BPF: S. McCanne and
  • V. Jacobson. The BSD packet filter: A new architecture for user-

level packet capture. USENIX ATC ’93.

  • ClamAV: A. Wu. Bytecode signatures for polymorphic malware.

http://blog.clamav.net/2011/11/bytecode-signatures-for-polymorphic.html.

  • RarVM: T. Ormandy. Fun with constrained programming.

http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html.

  • FreeType: J. Sigwald. Analysis of the jailbreakme v3 font exploit.

http://esec-lab.sogeti.com/post/Analysis-of-the-jailbreakme-v3-font-exploit.

  • Pickles: M. Slaviero. Sour pickles: Shellcoding in Python’s serialization format. https://

media.blackhat.com/bh-us-11/Slaviero/BH_US_11_Slaviero_Sour_Pickles_WP .pdf.

  • DWARF: J. Oakley and S. Bratus. Exploiting the hard-working DWARF:

Trojan and exploit techniques with no native executable code. USENIX WOOT ’11.

  • JIT: C. Rohlf and
  • Y. Ivnitskiy. The security challenges of client-side Just-in-Time engines.

IEEE S&P ’12.

slide-93
SLIDE 93

Conclusion

  • Embedded interpreters and their

vulnerabilities are prevalent in real world

  • Pitfalls and security guidelines
  • Research opportunities
  • Testing embedded interpreters
  • Building reusable embedded interpreters
slide-94
SLIDE 94

Q & A

Security Bugs in Embedded Interpreters

Haogang Chen, Cody Cutler, Taesoo Kim, Yandong Mao, Xi Wang, Nickolai Zeldovich and M. Frans Kaashoek MIT CSAIL