xxx tolerating malicious drivers in linux

play

XXX Tolerating Malicious Drivers in Linux Silas Boyd-Wickizer and - PowerPoint PPT Presentation

Sep 30, 2023 •663 likes •1.63k views

XXX Tolerating Malicious Drivers in Linux Silas Boyd-Wickizer and Nickolai Zeldovich How could a device driver be malicious? Today's device drivers are highly privileged Write kernel memory, allocate memory, ... Drivers are complex;

XXX
Tolerating Malicious Drivers in Linux Silas Boyd-Wickizer and Nickolai Zeldovich
How could a device driver be malicious? Today's device drivers are highly privileged Write kernel memory, allocate memory, ... Drivers are complex; developers write buggy code Result: Attackers exploit vulnerabilities
How could a device driver be malicious? Today's device drivers are highly privileged Write kernel memory, allocate memory, ... Drivers are complex; developers write buggy code Result: Attackers exploit vulnerabilities
How could a device driver be malicious? Today's device drivers are highly privileged Write kernel memory, allocate memory, ... Drivers are complex; developers write buggy code Result: Attackers exploit vulnerabilities
Current approach User-space drivers in µ kernels (Minix, L4, ...) Write device driver in new language (Termite) Handle common faults (Nooks, microdrivers, ...)
Goal Secure, efficient, & unmodified drivers on Linux
Previous user-space drivers µ kernel User User User Ethernet Network Application driver stack Hardware Kernel Kernel core
Previous user-space drivers µ kernel Confine driver in a process User User User Ethernet Network Application driver stack Hardware Kernel Kernel core
Previous user-space drivers µ kernel Confine driver in a process User User User Ethernet Network Application driver stack Hardware Kernel General purpose syscall API to configure device Kernel core
Previous user-space drivers µ kernel Confine driver in a process User User User Ethernet Network Application driver stack Hardware Kernel General purpose syscall API to configure device Kernel core Confine device with IO virtualization HW.
Previous user-space drivers IPC network driver API µ kernel E.g. tx_packet Confine driver in a process User User User Ethernet Network Application driver stack Hardware Kernel General purpose syscall API to configure device Kernel core Confine device with IO virtualization HW.
Current Linux driver architecture User Application Hardware Kernel Ethernet Network driver stack Kernel RT netdevice
Current Linux driver architecture User Application Kernel runtime (e.g. kmalloc ) Hardware Kernel Ethernet Network driver stack Kernel RT netdevice
Current Linux driver architecture User Network driver API (e.g. tx_packet ) Application Kernel runtime (e.g. kmalloc ) Hardware Kernel Ethernet Network driver stack Kernel RT netdevice
Linux user-space driver problem Kernel RT and driver APIs won't work for untrusted drivers in a different AS Ethernet User User driver Application Hardware Kernel Network stack Kernel RT netdevice
SUD's approach Ethernet User User driver Application Hardware Kernel Network stack Kernel RT netdevice
SUD's approach SUD UML handles calls to kernel RT Ethernet User User driver Application Hardware SUD UML Kernel Network stack Kernel RT netdevice
SUD's approach SUD UML handles calls to kernel RT Proxy driver and SUD UML allow reuse of existing driver APIs Ethernet User User driver Application Hardware SUD UML Kernel Ethernet Network proxy driver stack Kernel RT netdevice
SUD's approach SUD UML handles calls to kernel RT Proxy driver and SUD UML allow reuse of existing driver APIs Ethernet User User driver Application Hardware SUD UML Network driver API Kernel Ethernet Network proxy driver stack Kernel RT netdevice
SUD's approach SUD UML handles calls to kernel RT Proxy driver and SUD UML allow reuse of existing driver APIs Ethernet User User driver Application Hardware SUD UML SUD RPC API Network driver API Kernel Ethernet Network proxy driver stack Kernel RT netdevice
SUD's approach SUD UML handles calls to kernel RT Proxy driver and SUD UML allow reuse of existing driver APIs Network driver API Ethernet User User driver Application Hardware SUD UML SUD RPC API Network driver API Kernel Ethernet Network proxy driver stack Kernel RT netdevice
SUD's results Tolerate malicious device drivers Proxy drivers small (~500 LOC) One proxy driver per device class Few kernel modifications (~50 LOC) Unmodified drivers (6 test drivers) High performance, low overhead No need for new OS or language
Security challenge: prevent attacks Problem: driver must perform privileged operations Memory access, driver API, DMA, interrupts, … Attacks from driver code: Direct system attacks: memory corruption, ... Driver API attacks: invalid return value, deadlock, ... Attacks from device: DMA to DRAM, peer-to-peer attacks, interrupt storms
Practical challenges High performance, low overhead Challenge: interact with hardware and kernel at high rate, kernel-user switch expensive E.g. Ethernet driver ~100k times a second Reuse existing drivers and kernel Challenge: drivers assume fully-privileged kernel env. Challenge: kernel driver API complex, non-uniform
SUD overview Hardware User User Driver Application SUD UML Kernel HW access Proxy driver Kernel core module
SUD overview Hardware User User Driver Application SUD UML Kernel HW access Proxy driver Kernel core module
Linux driver APIs Linux defines a driver API for each device class Driver and kernel functions and variables
Example: wireless driver API Linux defines a driver API for each device class Driver and kernel functions and variables struct wireless_ops { int (*tx)(struct sk_buff*); int (*configure_filter)(int); ... }; struct wireless_hw { int conf; int flags .... };
Example: wireless driver API Linux defines a driver API for each device class Driver and kernel functions and variables struct wireless_ops { int (*tx)(struct sk_buff*); int (*configure_filter)(int); ... }; struct wireless_hw { int conf; int flags .... }; Proxy drivers and SUD-UML convert API to RPCs
Example: wireless driver API Linux defines a driver API for each device class Driver and kernel functions and variables struct wireless_ops { int (*tx)(struct sk_buff*); int (*configure_filter)(int); ... }; struct wireless_hw { int conf; int flags .... }; Proxy drivers and SUD-UML convert API to RPCs
Example: wireless driver API Linux defines a driver API for each device class Driver and kernel functions and variables Called in a non- struct wireless_ops { preemptable context int (*tx)(struct sk_buff*); int (*configure_filter)(int); ... }; struct wireless_hw { int conf; int flags .... }; Proxy drivers and SUD-UML convert API to RPCs
Example: wireless driver API Linux defines a driver API for each device class Driver and kernel functions and variables Called in a non- struct wireless_ops { preemptable context int (*tx)(struct sk_buff*); int (*configure_filter)(int); ... Driver API variable }; struct wireless_hw { int conf; int flags .... }; Proxy drivers and SUD-UML convert API to RPCs
Wireless driver in SUD Basic driver API → SUD RPC API→ driver API Non-preemptable function: implement in proxy Driver API variable: shadow variables
Example 1: transmit a packet User User Wireless Web driver browser SUD UML Hardware Kernel Wireless Wireless proxy driver core
Example 1: transmit a packet User User Socket write Wireless Web driver browser SUD UML Hardware Kernel Wireless Wireless proxy driver core
Example 1: transmit a packet User User Wireless Web driver browser SUD UML Hardware wireless_ops.tx Kernel Wireless Wireless proxy driver core
Example 1: transmit a packet User User TX packet RPC Wireless Web driver browser SUD UML Hardware Kernel Wireless Wireless proxy driver core
Example 1: transmit a packet wireless_ops.tx User User Wireless Web driver browser SUD UML Hardware Kernel Wireless Wireless proxy driver core
Example 1: transmit a packet DMA TX User User Wireless Web driver browser SUD UML Hardware Kernel Wireless Wireless proxy driver core
Example 2: non-preemptable callback Problem: unable to switch to user-space User User Wireless Web driver browser SUD UML Hardware Kernel Wireless Wireless proxy driver core
Example 2: non-preemptable callback Problem: unable to switch to user-space User User Wireless Web driver browser Acquires a SUD UML Hardware spin lock Kernel Wireless Wireless proxy driver core
Example 2: non-preemptable callback Problem: unable to switch to user-space User User Wireless Web driver browser SUD UML Hardware wireless_ops.configure_filter Kernel Wireless Wireless proxy driver core
Example 2: non-preemptable callback Problem: unable to switch to user-space User User Filter RPC Wireless Web driver browser SUD UML Hardware Kernel Wireless Wireless proxy driver core
Example 2: non-preemptable callback Problem: unable to switch to user-space User User Wireless Web driver browser SUD UML Hardware Kernel Wireless Wireless proxy driver core
Example 2: non-preemptable callback Problem: unable to switch to user-space Solution: implement directly in proxy driver User User Wireless Web driver browser SUD UML Hardware Kernel Wireless Wireless proxy driver core

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

More recommend