Abstract:Due to its faster start-up speed and better resource utilization efficiency, OS-level virtualization has been widely adopted and has become a fundamental technology in cloud computing. Compared to hardware virtualization, OS-level virtualization leverages the shared-kernel design to achieve high efficiency and runs multiple user-space instances (a.k.a., containers) on the shared kernel. However, in this paper, we reveal a new attack surface that is intrinsic to OS-level virtualization, affecting Linux, FreeBSD, and Fuchsia. The root cause is that the shared-kernel design in OS-level virtualization results containers in sharing thousands of kernel variables and data structures directly and indirectly. Without exploiting any kernel vulnerabilities, a non-privileged container can easily exhaust the shared kernel variables and data structure instances to cause DoS attacks against other containers. Compared with the physical resources, these kernel variables or data structure instances (termed abstract resources) are more prevalent but under-protected. To show the importance of confining abstract resources, we conduct abstract resource attacks that target different aspects of the OS kernel. The results show that attacking abstract resources is highly practical and critical. We further conduct a systematic analysis to identify vulnerable abstract resources in the Linux kernel, which successfully detects 1,010 abstract resources and 501 of them can be repeatedly consumed dynamically. We also conduct the attacking experiments in the self-deployed shared-kernel container environments on the top 4 cloud vendors. The results show that all environments are vulnerable to abstract resource attacks. We conclude that containing abstract resources is hard and give out multiple strategies for mitigating the risks.

DKSM: Subverting Virtual Machine Introspection for Fun and Profit

Active and passive virtual machine introspection on AMD and ARM processors

Exploring Efficient and Robust Virtual Machine Introspection Techniques.

On The Detection Of Malicious Behaviors Against Introspection Using Hardware Architectural Events

Exploiting Interfaces of Secure Encrypted Virtual Machines

Kernel Intrusion Detection Method Based on Xen Hypervisor

Lightweight Intrusion Detection of Rootkit with VMI-Based Driver Separation Mechanism.

Using An In-Kernel Hypervisor To Protect The Integrity Of Operating System

Demons in the Shared Kernel

Hardware assisted hypervisor introspection

Concurrent and consistent virtual machine introspection with hardware transactional memory

Transparency and Semantics Coexist: When Malware Analysis Meets the Hardware Assisted Virtualization

System Call Redirection: A Practical Approach to Meeting Real-World Virtual Machine Introspection Needs

Demons in the Shared Kernel: Abstract Resource Attacks Against OS-level Virtualization

Catch You with Cache: Out-of-VM Introspection to Trace Malicious Executions.

Narrowing the Semantic Gap in Virtual Machine Introspection

Heckler: Breaking Confidential VMs with Malicious Interrupts

Approach of Kernel Integrity Monitoring Using Hardware Virtualization

Seeing Through the Same Lens: Introspecting Guest Address Space at Native Speed.

Attacks are Forwarded: Breaking the Isolation of MicroVM-based Containers Through Operation Forwarding

Kernel Code Integrity Protection Based on a Virtualized Memory Architecture.