System Security Overview with an Emphasis on Security Issues for - - PowerPoint PPT Presentation

▶
system security overview
SMART_READER_LITE
LIVE PREVIEW

System Security Overview with an Emphasis on Security Issues for - - PowerPoint PPT Presentation

Jul 11, 2023 397 likes •1.47k views

System Security Overview with an Emphasis on Security Issues for Storage and Emerging NVM (Part 1) Byoungyoung Lee ( ) byoungyoung@snu.ac.kr Seoul National University 1 Speaker: Byoungyoung Lee ( ) Research areas:

slide-1
SLIDE 1

System Security Overview with an Emphasis on Security Issues for Storage and Emerging NVM (Part 1)

Byoungyoung Lee (이병영) byoungyoung@snu.ac.kr Seoul National University

1

slide-2
SLIDE 2

Speaker: Byoungyoung Lee (이병영)

  • Research areas: Hacking, Systems Security, Software Security
  • Found 100++ vulnerabilities from Windows kernel, Linux kernel, Chrome, Firefox,

etc.

  • Internet Defense Prize by Facebook and USENIX (2015)
  • Three times DEFCON CTF Finalist (2007,2009, and 2011)
  • DARPA Cyber Grand Challenge (CGC) Finalist (2016)

2

slide-3
SLIDE 3

My Research Areas: Protecting Commodity Systems

Apps OS HW

Juxta [SOSP 15] Kenali [NDSS 16] KUP [ATC 16] Razzer [S&P 19] Morula [S&P 14] DangNull [NDSS 15] Expector [WWW 15] TrackMeOrNot [WWW 16] MEDS [NDSS 18] CaVer [USENIX Sec 15] HexType [CCS 17]

3

CAB-Fuzz [ATC 17] ASLR-Guard [CCS 15] HDFI [S&P 16] Minion [NDSS 18] SGX-ASLR [NDSS 17] Obliviate [NDSS 18]

slide-4
SLIDE 4

My Research Areas: Protecting Commodity Systems

Apps OS HW

Juxta [SOSP 15] Kenali [NDSS 16] KUP [ATC 16] Razzer [S&P 19] Morula [S&P 14] DangNull [NDSS 15] Expector [WWW 15] TrackMeOrNot [WWW 16] MEDS [NDSS 18] CaVer [USENIX Sec 15] HexType [CCS 17]

3

CAB-Fuzz [ATC 17] ASLR-Guard [CCS 15] HDFI [S&P 16] Minion [NDSS 18] SGX-ASLR [NDSS 17] Obliviate [NDSS 18]

Attack Mitigation

slide-5
SLIDE 5

My Research Areas: Protecting Commodity Systems

Apps OS HW

Juxta [SOSP 15] Kenali [NDSS 16] KUP [ATC 16] Razzer [S&P 19] Morula [S&P 14] DangNull [NDSS 15] Expector [WWW 15] TrackMeOrNot [WWW 16] MEDS [NDSS 18] CaVer [USENIX Sec 15] HexType [CCS 17]

3

CAB-Fuzz [ATC 17] ASLR-Guard [CCS 15] HDFI [S&P 16] Minion [NDSS 18] SGX-ASLR [NDSS 17] Obliviate [NDSS 18]

Attack Mitigation Vulnerability Finding

slide-6
SLIDE 6

My Research Areas: Protecting Commodity Systems

Apps OS HW

Juxta [SOSP 15] Kenali [NDSS 16] KUP [ATC 16] Razzer [S&P 19] Morula [S&P 14] DangNull [NDSS 15] Expector [WWW 15] TrackMeOrNot [WWW 16] MEDS [NDSS 18] CaVer [USENIX Sec 15] HexType [CCS 17]

3

CAB-Fuzz [ATC 17] ASLR-Guard [CCS 15] HDFI [S&P 16] Minion [NDSS 18] SGX-ASLR [NDSS 17] Obliviate [NDSS 18]

Attack Mitigation Vulnerability Finding Secure Trusted Comtputing

slide-7
SLIDE 7
  • Part1. Bugs in File Systems

Semantic inconsistency inference Fuzzing

  • Part2. Attacks and Defenses

Ransomware Cold boot attacks Side-channels

4

Outline

slide-8
SLIDE 8

File system bugs are critical

5

slide-9
SLIDE 9

File system bugs are critical

5

slide-10
SLIDE 10

File system bugs are critical

5

slide-11
SLIDE 11

Bug Patterns in File Systems

“A study of Linux File System Evolution [FAST 13]”

Bug pattern Description Semantic

  • Incorrect design or implementation
  • e.g., incorrect state update, wrong design

Concurrency

  • Incorrect concurrent behavior
  • e.g., miss unlock, deadlock

Memory

  • Incorrect handling of memory objects
  • e.g., resource leak, null dereference

Error code

  • Missing or wrong error code handling
  • e.g., return wrong error code

6

slide-12
SLIDE 12

Bug Patterns in File Systems

“A study of Linux File System Evolution [FAST 13]”

7

slide-13
SLIDE 13

How to stop bleeding from bugs

  • Detection
  • Static analysis
  • Dynamic analysis
  • Prevention
  • Formal proof-assisted development (FSCQ [SOSP15])
  • Use type-safe languages
  • Minimizing negative security impacts
  • Isolation
  • A principle of least privileges
  • Data backup

8

slide-14
SLIDE 14

Bug Detection Techniques in General

  • Static analysis
  • Analyzing an implementation without running
  • Low false negative: complete coverage can be guaranteed
  • High false positives: difficult to determine if it’s truly a bug
  • Dynamic analysis
  • Analyzing an implementation while running
  • Low false positive: capable of generating evidence of bugs
  • High false negatives: bug detection capability is limited by its testing

coverage

9

slide-15
SLIDE 15

Detection Methods per Bug Pattern

Bug pattern Detection Methods Semantic Model inference from specification Semantic inconsistency inference [PLDI 07, SOSP 15] Concurrency Model checking Random thread interleaving: SKI [OSDI 14] Fuzzing: Razzer [S&P 19] Memory Static program analysis (Points-to analysis) Symbolic execution: KLEE [OSDI 08] Fuzzing Error code Model inference from specification Semantic inconsistency inference

10

slide-16
SLIDE 16
  • Part1. Bugs in File Systems

Semantic inconsistency inference Fuzzing

  • Part2. Attacks and Defenses

Ransomware Cold boot attacks Side-channels

11

Outline

slide-17
SLIDE 17

Semantic Bugs

  • Semantic bugs
  • Difficult to define violation conditions
  • Most semantic bugs are discovered by manual auditing
  • Semantic bugs include
  • Incorrect condition check
  • Incorrect status update
  • Incorrect argument
  • Incorrect error code
  • …

12

slide-18
SLIDE 18

Example of Semantic Bug

  • Missing Capability Check in OCFS2

Can we find this bug by leveraging

  • ther implementations?

13

slide-19
SLIDE 19

Example of Semantic Bug

  • Missing Capability Check in OCFS2

Deviant implementations  Potential bugs?

14

slide-20
SLIDE 20

Case Study: Write a page

  • Each file system defines how to write a page
  • Semantic of writepage()
  • Success  return locked page
  • Failure  return unlocked page
  • Document/filesystem/vfs specifies such a rule
  • Hard to detect semantic violations without domain knowledge

What if 99% file systems follow above pattern, But not one file system? Will it be a bug?

15

slide-21
SLIDE 21

Juxta [SOSP 15]: Approaches

  • Intuition
  • Bugs are rare
  • Majority of implementations is correct
  • Idea
  • Find deviant ones as potential bugs

16

slide-22
SLIDE 22

Juxta: overview

17

slide-23
SLIDE 23

Juxta: Results Summary

  • New semantic bugs
  • 118 new bugs in 54 file systems
  • Critical bugs
  • System crash, data corruption, deadlock, etc.
  • Bugs difficult to find
  • Bugs were hidden for 6.2 years on average
  • Various kinds of bugs
  • Condition check, argument use, return value, locking, etc.

18

slide-24
SLIDE 24
  • Part1. Bugs in File Systems

Semantic inconsistency inference Fuzzing

  • Part2. Attacks and Defenses

Ransomware Cold boot attacks Side-channels

19

Outline

slide-25
SLIDE 25

What programs do

Program

20

slide-26
SLIDE 26

What programs do

Program Input

20

slide-27
SLIDE 27

What programs do

Program Input Output

20

slide-28
SLIDE 28

Vulnerability

Program

21

slide-29
SLIDE 29

Vulnerability

Program input

21

slide-30
SLIDE 30

Vulnerability

Program input

21

slide-31
SLIDE 31

Vulnerability

Program input

For some input, the program acts weird (e.g., crash, hanging, etc.)

21

slide-32
SLIDE 32

Vulnerability

Program input

For some input, the program acts weird (e.g., crash, hanging, etc.)

21

slide-33
SLIDE 33

Vulnerability

Program input

For some input, the program acts weird (e.g., crash, hanging, etc.)

21

slide-34
SLIDE 34

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; i=0; while (1) { input[i] = output[i]; if (input[i] == 0) break; i++; }

22

slide-35
SLIDE 35

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4];

22

slide-36
SLIDE 36

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

22

slide-37
SLIDE 37

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

22

slide-38
SLIDE 38

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-39
SLIDE 39

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-40
SLIDE 40

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-41
SLIDE 41

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-42
SLIDE 42

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-43
SLIDE 43

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-44
SLIDE 44

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-45
SLIDE 45

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-46
SLIDE 46

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-47
SLIDE 47

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

22

slide-48
SLIDE 48

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

If strlen(input) > 4, a vulnerability occurs.

22

slide-49
SLIDE 49

Vulnerability: Example (Stack Overflow)

char input[8]; char output[4]; strcpy(output, input);

input

  • utput

If strlen(input) > 4, a vulnerability occurs.

  • Q. How to automatically know

the program will act bad if strlen(input) > 4?

22

slide-50
SLIDE 50

Fuzzing: Random Testing!

Program input

23

slide-51
SLIDE 51

Fuzzing: Random Testing!

Program input

Fuzzing algorithm

23

slide-52
SLIDE 52

Fuzzing: Random Testing!

Program input

#1. Randomly pick input xR ∈ X Fuzzing algorithm

23

slide-53
SLIDE 53

Fuzzing: Random Testing!

Program input

#1. Randomly pick input xR ∈ X Fuzzing algorithm #2. Run the program using xR

  • If something bad occurs,

XR induces a vulnerability

23

slide-54
SLIDE 54

Fuzzing: Random Testing!

Program input

#1. Randomly pick input xR ∈ X Fuzzing algorithm #2. Run the program using xR

  • If something bad occurs,

XR induces a vulnerability #3. Go back to step #1

23

slide-55
SLIDE 55

Fuzzing in the old days: Excel example

Randomly Generate/mutate an Excel file

24

slide-56
SLIDE 56

Fuzzing in the old days: Excel example

Randomly Generate/mutate an Excel file Run Excel

24

slide-57
SLIDE 57

Fuzzing in the old days: Excel example

Randomly Generate/mutate an Excel file Run Excel Crash!

24

slide-58
SLIDE 58

Fuzzing in the old days: Excel example

Randomly Generate/mutate an Excel file Run Excel Crash!

Finding a crashing input gets harder and harder 

24

slide-59
SLIDE 59

Fuzzing: Desired Features

  • Fuzzing attempts to
  • Detect explicit violation
  • While exploring all different program states in a given implementation
  • Desired features
  • Good violation detection capability
  • Exploring all different program states

25

slide-60
SLIDE 60

Fuzzing: Good Violation Detection Capability

  • Memory bug
  • Violation conditions are clear
  • Per-pointer capability w.r.t. accessing memory space
  • Concurrency bug
  • Violation conditions are clear
  • If race occurs, it is undefined behavior
  • Challenges: False positive issues in concurrency bug detection
  • Undefined behavior can be implementation-defined behavior
  • Developers may intentionally introduce races
  • Difficult to differentiate benign VS harmful races
  • Semantic bug
  • Challenges: Violation conditions are unclear
  • We don’t even know violation conditions
  • Only assertions (manually inserted by developers) may help
  • Only a few research have been done

26

slide-61
SLIDE 61

Fuzzing: Exploring all different program states

  • State exploration and bug finding
  • More code coverage  More complete testing  More bugs
  • Most fuzzing techniques take coverage-oriented genetic algorithm (proposed by AFL)
  • Coverage-oriented genetic algorithm for fuzzing
  • Design an object function f to evaluate goodness of input’s coverage
  • Algorithm
  • Initialize a corpus C
  • Corpus: a set of inputs to be mutated
  • Generate an input i
  • Generation: Randomly generate i from scratch
  • Mutation: Pick c from C, and then mutate c
  • If f(i) >= f(c) for all c in C
  • Add input i to the corpus C

27

slide-62
SLIDE 62

Fuzzing: Exploring all different program states

  • Covering complete context sensitivity is challenging
  • Concurrency bugs are much more complex
  • Scheduler mechanisms can be seen as non-deterministic
  • For fuzzing, input definition is complicated
  • Should consider thread interleaving
  • Related to hardness of race bug reproduction

28

slide-63
SLIDE 63

Challenges in Fuzzing: Violation Detection

input

  • utput

29

slide-64
SLIDE 64

Challenges in Fuzzing: Violation Detection

input

  • utput

This crash may not be observable in practice. It may simply overwrite some other variables, and it won't involve critically bad behaviors.

29

slide-65
SLIDE 65

Memory error bugs

  • Spatial safety violation
  • When accessing beyond allocated memory regions
  • e.g., stack overflow, heap overflow
  • Temporal safety violation
  • When accessing deallocated memory regions
  • e.g., use-after-free, double-free

30

slide-66
SLIDE 66

Memory Error: Detection Approaches

  • Pointer-based detection
  • Keep track of each pointer’s capability w.r.t. memory accesses
  • Software: SoftBound [PLDI 09], CETS [ISMM 10]
  • Hardware: Watch Dog [ISCA 12], Intel Memory Protection Extension (MPX)
  • Redzone-based detection
  • Keep track of global memory space accessibility
  • Software: AddressSanitizer [ATC 12]
  • Hardware: REST [ISCA 18]

31

slide-67
SLIDE 67

SoftBound [PLDI 09]

  • Maintain per-pointer metadata
  • (base, bound) per pointer
  • Runtime safety enforcement
  • All memory access should be within the range (base, base+bound)
  • Metadata propagation
  • Per-pointer metadata is propagated when performing pointer arithmetic operations
  • Disjoint metadata scheme
  • For better compatiblity, metadata space is isolated from original program’s memory

space

32

slide-68
SLIDE 68

Intel MPX

  • Hardware-assisted version of SoftBound
  • Hardware-assisted metadata management
  • Metadata management: Bound registers + Bound table
  • Bound registers
  • (base, bound) information is now stored in CPU registers
  • Fast bound check: a dedicated instruction is supported by MPX
  • Bound table
  • Used if bound registers are not available
  • Limitations
  • Compatibility issues (arbitrary type casting, external libraries, multi-threading)
  • More details: Intel MPX Explained [SIGMETRICS 18]

33

slide-69
SLIDE 69

AddressSanitizer [ATC 12]

  • Buffer overflow (spatial memory errors)

34

  • bjX

ptrX Shadow memory Check before access Accessible

Shadow memory: a bitmap to validate all addresses

slide-70
SLIDE 70

AddressSanitizer [ATC 12]

  • Buffer overflow (spatial memory errors)

34

  • bjX

ptrX Shadow memory Check before access Inaccessible (redzone) Accessible

Shadow memory: a bitmap to validate all addresses Redzone: inaccessible region between objects

slide-71
SLIDE 71

AddressSanitizer [ATC 12]

  • Buffer overflow (spatial memory errors)

34

  • bjX

ptrX Shadow memory Inaccessible (redzone) Accessible

Shadow memory: a bitmap to validate all addresses Redzone: inaccessible region between objects

Error!

slide-72
SLIDE 72

AddressSanitizer [ATC 12]

  • Use-after-free (Temporal memory errors)

35

  • bjX

Inaccessible Accessible ptrX Shadow memory

slide-73
SLIDE 73

AddressSanitizer [ATC 12]

  • Use-after-free (Temporal memory errors)

35

  • bjX

Inaccessible Accessible Quarant- ined ptrX ptrX free(ptrX) Shadow memory

Region is invalidated and quarantined, but not deallocated

slide-74
SLIDE 74

AddressSanitizer [ATC 12]

  • Use-after-free (Temporal memory errors)

35

  • bjX

Inaccessible Accessible Quarant- ined ptrX ptrX free(ptrX) Shadow memory

Hold the region until quarantine zone is full (FIFO)

slide-75
SLIDE 75

AddressSanitizer [ATC 12]

  • Use-after-free (Temporal memory errors)

35

  • bjX

Inaccessible Accessible Quarant- ined ptrX ptrX

  • bjY

ptrY free(ptrX) ptrY = malloc() Shadow memory

The region is actually deallocated, and can be allocated for a new object

slide-76
SLIDE 76

REST [ISCA 18]

  • Hardware-assisted version of AddressSanitizer
  • A fixed token value in redzone
  • A pre-determined random value (in 64-byte space) is reserved for

representing an invalid memory region

  • No need to maintain shadow memory
  • Validity checks on memory read/write can be very efficient
  • Simply check if the token bit (in cache) is set

36

slide-77
SLIDE 77

Race condition

  • Race conditions
  • If following three conditions meet
  • Two instructions access the same memory location
  • At least one of two is a write instruction
  • These two are executed concurrently
  • If a race condition occurs, the computational results may

vary depending on the execution order.

37

slide-78
SLIDE 78

Race condition: A simple example

a = 0; If (a) { b = 0; } else { b = 1; } a = 1; Thread 1 Thread 2

38

slide-79
SLIDE 79

Race condition: A simple example

a = 0; If (a) { b = 0; } else { b = 1; } a = 1;

b will be 1

Thread 1 Thread 2

38

slide-80
SLIDE 80

Race condition: A simple example

a = 0; If (a) { b = 0; } else { b = 1; } a = 1; a = 0; If (a) { b = 0; } else { b = 1; } a = 1;

b will be 1

Thread 1 Thread 2 Thread 1 Thread 2

38

slide-81
SLIDE 81

Race condition: A simple example

a = 0; If (a) { b = 0; } else { b = 1; } a = 1; a = 0; If (a) { b = 0; } else { b = 1; } a = 1;

b will be 1 b will be 0

Thread 1 Thread 2 Thread 1 Thread 2

38

slide-82
SLIDE 82

int fd = open(”/dev/ptmx”); ioctl(fd, TCFLSH); write(fd, “……”);

User thread A User thread B User Kernel

ioctl(fd, TCXONC); close(fd);

Kernel thread A Kernel thread B

266: if (n_hdlc->flag & TCXONC) 267: while (list_empty(free_list)) { 268: buf = pop_front(free_list); 269: kfree(buf); 270: }

Real-world race example: CVE-2017-2636 (Linux Kernel)

217: if (tbuf) 218: push_back(free_list, tbuf); 216: tbuf = n_hdlc->tbuf; 441: } 440: n_hdlc->tbuf = NULL; 431: if (n_hdlc->tbuf) { 432: push_back(free_list, n_hdlc->tbuf);

39

slide-83
SLIDE 83

int fd = open(”/dev/ptmx”); ioctl(fd, TCFLSH); write(fd, “……”);

User thread A User thread B User Kernel

ioctl(fd, TCXONC); close(fd);

Kernel thread A Kernel thread B

266: if (n_hdlc->flag & TCXONC) 267: while (list_empty(free_list)) { 268: buf = pop_front(free_list); 269: kfree(buf); 270: }

This will turn into “double-free”, which in turn allows a privilege escalation

Real-world race example: CVE-2017-2636 (Linux Kernel)

217: if (tbuf) 218: push_back(free_list, tbuf); 216: tbuf = n_hdlc->tbuf; 441: } 440: n_hdlc->tbuf = NULL; 431: if (n_hdlc->tbuf) { 432: push_back(free_list, n_hdlc->tbuf);

39

slide-84
SLIDE 84

Race condition and fuzzing

  • Finding race conditions through fuzzing is challenging
  • How to execution racing pair instructions concurrently?
  • All the execution interleaving (scheduling) is “randomly” determined
  • Case study: Previous techniques
  • Syzkaller: a system call fuzzer for the Linux kernel
  • SKI: an academic prototype to find a race [OSDI 14]

40

slide-85
SLIDE 85

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

… … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

41

slide-86
SLIDE 86

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

⬤ : Syzkaller … … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

41

slide-87
SLIDE 87

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

u u ⬤ : Syzkaller … … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

41

slide-88
SLIDE 88

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

u u v v ⬤ : Syzkaller … … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

41

slide-89
SLIDE 89

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

u u v v ⬤ : Syzkaller … … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

⃝ : SKI

41

slide-90
SLIDE 90

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

u u v v

①

⬤ : Syzkaller … … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

⃝ : SKI

41

slide-91
SLIDE 91

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

u u v v

② ①

⬤ : Syzkaller … … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

⃝ : SKI

41

slide-92
SLIDE 92

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

u u v v

② ① ③

⬤ : Syzkaller … … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

⃝ : SKI

41

slide-93
SLIDE 93

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

u u v v

② ① ③ ④

⬤ : Syzkaller … … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

⃝ : SKI

41

slide-94
SLIDE 94

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

u u v v

② ① ③ ④ ⑤

⬤ : Syzkaller

⑦ ⑥

… … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

⃝ : SKI

41

slide-95
SLIDE 95

Guest Kernel

`

Guest User

User Thread A User Thread B Kernel Thread A Kernel Thread B

…

movq $0, 0x20(%rbx) callq 0xffff……cbf0

… … mov -0x20(%rdi), %r8 test %r8, %r8 …

u u v v

② ① ③ ④ ⑤

⬤ : Syzkaller

⑦ ⑥

… … … …

… mov $0x2400,%esi add $0x10,%rdi … … cmp %r14,%r12 je ffff…..734 … … syscall i – 1 (w, …) syscall I (x, …) … … syscall j (y, …) syscall j + 1 (z, …) …

⃝ : SKI

Very unlikely to be executed concurrently  Very unlikely to trigger a race!

41

slide-96
SLIDE 96

Finding Kernel Races through Fuzzing

  • Razzer [S&P 19]
  • #1. Static analysis to find potential race spots
  • Points-to analysis over an entire kernel
  • #2. For each potential race spots, setup per-core breakpoint
  • Run the kernel on modified hypervisor (QEMU/KVM)
  • #3. Check if a race truly occurs
  • Prioritize a truly racing pair to be further fuzzed later

42

slide-97
SLIDE 97

sshd

…

Kernel thread A Kernel thread B ioctl(fd,TCFLSH) write(fd, “…”) User thread A User thread B

init

vCPU0 vCPU1 Guest user Guest Kernel Hypervisor movq $0, 0x20(%rbx) callq 0xffff……cbf0 mov 0x20(%rdi), %r8 test %r8, %r8

43

slide-98
SLIDE 98

sshd

…

Kernel thread A Kernel thread B ioctl(fd,TCFLSH) write(fd, “…”) User thread A User thread B

init

vCPU0 vCPU1 Guest user Guest Kernel Hypervisor movq $0, 0x20(%rbx) callq 0xffff……cbf0 Breakpoint mov 0x20(%rdi), %r8 test %r8, %r8

43

slide-99
SLIDE 99

sshd

…

Kernel thread A Kernel thread B ioctl(fd,TCFLSH) write(fd, “…”) User thread A User thread B

init

vCPU0 vCPU1 Guest user Guest Kernel Hypervisor movq $0, 0x20(%rbx) callq 0xffff……cbf0 Breakpoint uExecute uExecute mov 0x20(%rdi), %r8 test %r8, %r8

43

slide-100
SLIDE 100

sshd

…

Kernel thread A Kernel thread B ioctl(fd,TCFLSH) write(fd, “…”) User thread A User thread B

init

vCPU0 vCPU1 Guest user Guest Kernel Hypervisor movq $0, 0x20(%rbx) callq 0xffff……cbf0 Breakpoint

v

uExecute uExecute v mov 0x20(%rdi), %r8 test %r8, %r8

43

slide-101
SLIDE 101

sshd

…

Kernel thread A Kernel thread B ioctl(fd,TCFLSH) write(fd, “…”) User thread A User thread B

init

vCPU0 vCPU1 rdi: ffff8801e704c000 Guest user Guest Kernel Hypervisor movq $0, 0x20(%rbx) callq 0xffff……cbf0 Breakpoint

v

uExecute uExecute v

Ⓐ Check race

mov 0x20(%rdi), %r8 test %r8, %r8 rbx: ffff8801e704c000

43

slide-102
SLIDE 102

sshd

wSingle step

…

Kernel thread A Kernel thread B ioctl(fd,TCFLSH) write(fd, “…”) User thread A User thread B

init

vCPU0 vCPU1 rdi: ffff8801e704c000 Guest user Guest Kernel Hypervisor movq $0, 0x20(%rbx) callq 0xffff……cbf0 Breakpoint

v

uExecute uExecute v

Ⓐ Check race

mov 0x20(%rdi), %r8 test %r8, %r8 rbx: ffff8801e704c000

43

slide-103
SLIDE 103

sshd

wSingle step xContinue xContinue

…

Kernel thread A Kernel thread B ioctl(fd,TCFLSH) write(fd, “…”) User thread A User thread B

init

vCPU0 vCPU1 rdi: ffff8801e704c000 Guest user Guest Kernel Hypervisor movq $0, 0x20(%rbx) callq 0xffff……cbf0 Breakpoint

v

uExecute uExecute v

Ⓐ Check race

mov 0x20(%rdi), %r8 test %r8, %r8 rbx: ffff8801e704c000

43

slide-104
SLIDE 104
  • Results
  • 30 new races
  • 16 are fixed

44

slide-105
SLIDE 105

Discussion

  • Semantic bugs
  • Need to automatically synthesize safety assertions
  • Concurrency bugs
  • How to better reproduce races? (or find a root cause of races?)
  • How to better test?
  • Memory bugs
  • Enforcing memory access permissions by firmware
  • Granularity: Page-granularity? Byte-granularity?
  • Metadata: MMU like designs? MPU like designs?
  • Principals: Bisected principals (e.g., kernel/user)? Multiple principals (e.g., multi-users)?

45

slide-106
SLIDE 106

감사합니다.

이병영 서울대학교 전기정보공학부 byoungyoung@snu.ac.kr

46