[Paper Review] libmpk: Software Abstraction for Intel Memory Protection Keys

Soyeon Park, Sangho Lee+3 more|arXiv (Cornell University)|Nov 18, 2018

Security and Verification in Computing31 references9 citations

TL;DR

This paper proposes libmpk, a software abstraction for Intel Memory Protection Keys (MPK) that eliminates security flaws like use-after-free and key corruption, enables scalable management of over 16 memory page groups, and supports inter-thread permission synchronization. Evaluation shows libmpk adds <1% performance overhead and improves performance by 8.1× over mprotect()-based secure alternatives in OpenSSL, JavaScript JIT, and Memcached.

ABSTRACT

Intel memory protection keys (MPK) is a new hardware feature to support thread-local permission control on groups of pages without requiring modification of page tables. Unfortunately, its current hardware implementation and software supports suffer from security, scalability, and semantic-gap problems: (1) MPK is vulnerable to protection-key-use-after-free and protection-key corruption; (2) MPK does not scale due to hardware limitations; and (3) MPK is not perfectly compatible with mprotect() because it does not support permission synchronization across threads. In this paper, we propose libmpk, a software abstraction for MPK. libmpk virtualizes protection keys to eliminate the protection-key-use-after-free and protection-key corruption problems while supporting a tremendous number of memory page groups. libmpk also prevents unauthorized writes to its metadata and supports inter-thread key synchronization. We apply libmpk to three real-world applications: OpenSSL, JavaScript JIT compiler, and Memcached for memory protection and isolation. An evaluation shows that libmpk introduces negligible performance overhead (&lt;1%) compared with insecure versions, and improves their performance by 8.1x over secure equivalents using mprotect(). The source code of libmpk will be publicly available and maintained as an open source project.

Motivation & Objective

• To address critical security flaws in Intel MPK, including protection-key-use-after-free and key corruption due to uninitialized deallocated keys.
• To overcome MPK's hardware limitation of only 16 protection keys by enabling virtualization of keys for scalable memory partitioning.
• To bridge the semantic gap between MPK’s thread-level permission control and mprotect()’s process-level semantics through inter-thread key synchronization.
• To enable practical, high-performance memory isolation in real-world applications using a secure and efficient software abstraction.

Proposed method

• Virtualizing protection keys via a software-managed key space to decouple application-level keys from hardware limits, enabling support for thousands of virtual keys.
• Introducing a metadata structure to track key usage and prevent use-after-free by validating key state before access.
• Enforcing integrity of metadata through hardware-enforced memory protection and access control to prevent unauthorized modifications.
• Implementing inter-thread synchronization primitives to coordinate permission changes across threads, aligning MPK behavior with mprotect() semantics.
• Designing a system-call interface that abstracts MPK complexity while preserving performance, allowing seamless integration with existing applications.
• Leveraging existing MPK hardware features (e.g., WRPKRU) for fast permission updates, minimizing performance impact.

Experimental results

Research questions

• RQ1 Can a software abstraction mitigate the security vulnerabilities inherent in Intel MPK’s current implementation, such as use-after-free and key corruption?
• RQ2 Can a software layer overcome the hardware limitation of 16 protection keys to enable scalable memory partitioning in applications?
• RQ3 Can inter-thread permission synchronization be effectively modeled to align MPK’s thread-local behavior with the process-wide semantics of mprotect()?
• RQ4 What is the performance overhead of such an abstraction in real-world, production-grade applications?

Key findings

• libmpk introduces negligible performance overhead of less than 1% compared to insecure versions using raw MPK.
• When replacing mprotect() for secure memory protection, libmpk improves performance by 8.1× over mprotect()-based secure implementations in real-world applications.
• The abstraction successfully prevents protection-key-use-after-free and key corruption by validating key states and securing metadata with hardware-enforced protections.
• libmpk supports thousands of virtual memory page groups despite the hardware limit of 16 physical protection keys through key virtualization.
• Inter-thread permission synchronization is effectively modeled, resolving the semantic gap between MPK’s thread-level control and mprotect()’s process-level control.
• Evaluation on OpenSSL, JavaScript JIT compiler, and Memcached confirms that libmpk enables secure, high-performance memory isolation with minimal runtime cost.