Abstract:Nowadays, code reuse attacks impose a substantial threat to the security of operating system kernels. Control-flow graph-based CFI techniques, while effective, bring considerable performance overhead, thus limiting their practical adoption in real-world products. As an alternative approach, recent research suggests safeguarding the integrity of sensitive pointers as a countermeasure against manipulation attempts. Unfortunately, existing pointer integrity protection schemes only protect sensitive pointers partially and ignore assembly code, leaving protection gaps. To fill up these protection gaps, we propose a novel security concept named full life-cycle integrity , which enforces the integrity of a sensitive pointer at every step on its value flow chain. To realize full life-cycle integrity, we propose three novel techniques, including assembly-aware sensitivity for analyzing assembly code, Merkle PAC tree for protecting interrupt context securely and efficiently, and pointer-grained authentication for defeating spatial substitution attacks. We have developed a practical implementation of comprehensive life-cycle integrity for the Linux kernel, called ”kernel Code Pointer Authentication” (kCPA), which leverages the ARM Pointer Authentication (PAuth) mechanism. This implementation has been extended to the Apple M1 architecture for real-world evaluation on PAuth hardware. Our assessment demonstrates that kCPA effectively mitigates a range of real-world attacks while incurring a minimal 2.5% performance overhead for the Phoronix Test Suite and nearly negligible performance impact for SPEC2017 benchmarks.

Enforcing the principle of least privilege with a state-based privilege control model

A Framework for Implementing Dynamically Modified Least Privilege Security Policy

A Task-Role Based Access Control Model with Multi-Constraints

A Dynamically Modified Privilege Control Policy

Implementing the principle of least administrative privilege on operating systems: challenges and perspectives

Making Least Privilege The Low-Hanging Fruit In Clouds

Hybrid Mandatory Model Composed of BLP and Clark-Wilson Policy

Automated Enforcement of the Principle of Least Privilege over Data Source Access

Multi-level Access Control for Collaborative CAD

An Authorization Architecture Oriented to Engineering and Scientific Computation in Grid Environments

Kcpa: Towards Sensitive Pointer Full Life Cycle Authentication for OS Kernels

Formal Modeling and Security Analysis for Intra-level Privilege Separation.

An Access Control Frame Based on the Privilege of Program and It's Implementation in Linux

Process-based Access Control Model

Separation of Duty Constraint for Permission Based Delegation Model

Implementation and Automatic Testing for Security Enhancement of Linux Based on Least Privilege

The Separation of Duty with Privilege Calculus

Towards a multilayered permission-based access control for extending Android security.

Fine-grained Protection Domain Model in a Process and Its Implementation

Multilevel Multi-policy Access Control Model for Collaborative Application

Practical Control Flow Integrity and Randomization for Binary Executables