[论文解读] Still Hammerable and Exploitable: on the Effectiveness of Software-only Physical Kernel Isolation.

Yueqiang Cheng, Zhi Zhang+1 more|arXiv (Cornell University)|Feb 20, 2018

Security and Verification in Computing参考文献 13被引用 13

一句话总结

本论文提出了一种新型的基于Rowhammer的攻击，通过利用内核与用户域之间共享的双所有者内核缓冲区，绕过了CATT——一种最先进的纯软件物理内核隔离技术。通过使用内存伏击技术以及高效的侧信道引导锤击算法，该攻击仅需128MB内存，在1至36分钟内即可实现根权限和内核权限，且不耗尽系统内存，也无需依赖虚拟到物理地址映射。

ABSTRACT

All the state-of-the-art rowhammer attacks can break the MMU-enforced inter-domain isolation based on the fact that the physical memory owned by each domain is adjacent to each other. To mitigate such attacks, CATT as the first generic and practical technique, essentially separates each domain physically. It divides the physical memory into multiple partitions and keeps each partition occupied by only one domain, called the single ownership invariant. Hence, all existing rowhammer attacks are effectively defeated. In this paper, we develop a novel practical exploit, which could effectively defeat CATT and gain both root and kernel privileges, without exhausting page cache and system memory, or relying on any virtual-to-physical mapping information. Specifically, our key observation is that on the modern OSes there exist double-ownership kernel buffers (e.g., video buffers) owned concurrently by the kernel and user domains, invalidating the singleownership invariant enforced by CATT and making the rowhammer-based attack become possible again. In contrast to existing conspicuous rowhammer exploits that exhaust page cache or even the whole system memory, we propose a new attack technique, named memory ambush, which is able to place the hammerable kernel buffers physically adjacent to the target objects (e.g., page tables) with only a small amount of memory, making our exploit stealthier and fewer memory fingerprints. We also replace the inefficient rowhammer algorithm that blindly picks up addresses for hammering with an efficient one, which probes suitable addresses using a side channel. We implement our exploit on the Linux kernel 4.10.0-generic. Our experiment results indicate that our exploit is able to gain the root and kernel privileges within roughly 1 to 36 minutes. The occupied memory could be reduced to 128MB.

研究动机与目标

• 调查现代操作系统在CATT实施物理内存分区的情况下是否仍允许Rowhammer攻击。
• 识别并利用违反CATT单一所有者不变量的双所有者内核缓冲区的存在。
• 设计一种更隐蔽、内存效率更高的Rowhammer攻击，避免页缓存耗尽及对虚拟到物理地址映射的依赖。
• 在真实的Linux环境中演示一次可行的权限提升攻击，实现根权限和内核访问。

提出的方法

• 识别内核与用户域之间共享的双所有者内核缓冲区（如视频缓冲区），这些缓冲区违反了CATT的单一所有者不变量。
• 开发一种内存伏击技术，仅使用极小的内存占用，将可锤击的内核缓冲区物理邻近目标对象（如页表）。
• 实现一种高效的Rowhammer算法，利用侧信道探测并选择最优锤击地址，取代盲目地址选择。
• 设计攻击时避免耗尽系统内存或依赖虚拟到物理地址映射，以增强隐蔽性和实用性。
• 将该技术集成至Linux内核4.10.0-generic中，以在真实世界环境中验证攻击效果。
• 优化内存使用，将所需内存占用降低至最低128MB。

实验结果

研究问题

• RQ1 在强制每个域仅拥有单一物理内存所有权的CATT保护下，Rowhammer攻击是否仍能成功？
• RQ2 哪些系统级机制（如双所有者内核缓冲区）会无意中破坏CATT的隔离保证？
• RQ3 如何通过最小化内存消耗并避免页缓存耗尽，使Rowhammer攻击更加隐蔽？
• RQ4 侧信道技术能在多大程度上提升Rowhammer地址选择的效率？
• RQ5 此类攻击在真实Linux内核环境中的实际可行性与性能如何？

主要发现

• 该攻击通过利用违反单一所有者不变量的双所有者内核缓冲区，成功绕过了CATT。
• 内存伏击技术仅使用128MB内存，即可实现可锤击缓冲区与目标对象的物理邻近。
• 侧信道引导的锤击算法相比盲选地址，效率显著提升。
• 该攻击在Linux内核4.10.0-generic上于1至36分钟内成功获取根权限和内核权限。
• 该攻击留下的内存痕迹极少，比以往耗尽系统内存的Rowhammer攻击更具隐蔽性。
• 结果表明，仅依赖软件的物理隔离机制（如CATT）不足以防止复杂Rowhammer驱动的权限提升攻击。