Abstract:Stack canary is the most widely deployed defense technique against stack buffer overflow attacks. However, since its proposition, the design of stack canary has very few improvements during the past 20 years, making it vulnerable to new and sophisticated attacks. For example, the ARM64 Linux kernel is still adopting the same design with StackGuard, using one global canary for the whole kernel. The x86_64 Linux kernel leverages a better design by using a per-task canary for different threads. Unfortunately, both of them are vulnerable to kernel memory leaks. Using the memory leak bugs or hardware side-channel attacks, e.g., Meltdown or Spectre, attackers can easily peek the kernel stack canary value, thus bypassing the protection. To address this issue, we proposed a fine-grained design of the kernel stack canary named PESC, standing for Per-System-Call Canary, which changes the kernel canary value on the system call basis. With PESC, attackers cannot accumulate any knowledge of prior canary across multiple system calls. In other words, PESC is resilient to memory leaks. Our key observation is that before serving a system call, the kernel stack is empty and there are no residual canary values on the stack. As a result, we can directly change the canary value on system call entry without the burden of tracking and updating old canary values on the kernel stack. Moreover, to balance the performance as well as the security, we proposed two PESC designs: one relies on the performance monitor counter register, termed as PESC-PMC, while the other one uses the kernel random number generator, denoted as PESC-RNG. We implemented both PESC-PMC and PESC-RNG on the real-world hardware, using HiKey960 board for ARM64 and Intel i7-7700 for x86_64. The synthetic benchmark and SPEC CPU2006 experimental results show that the performance overhead introduced by PESC-PMC and PESC-RNG on the whole system is less than 1%.

Different is Good

Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers

Kcpa: Towards Sensitive Pointer Full Life Cycle Authentication for OS Kernels

KALD : Detecting Direct Pointer Disclosure Vulnerabilities

Towards Linux Kernel Memory Safety

The Illusion of Randomness: An Empirical Analysis of Address Space Layout Randomization Implementations

SoK: Eternal War in Memory

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack

Identifying Valuable Pointers in Heap Data

HeapTherapy: An Efficient End-to-End Solution against Heap Buffer Overflows

Comprehensive Kernel Safety in the Spectre Era: Mitigations and Performance Evaluation (Extended Version)

Fallout: Reading Kernel Writes From User Space

An Analysis of Speculative Type Confusion Vulnerabilities in the Wild

PESC: A Per System-Call Stack Canary Design for Linux Kernel

On Kernel's Safety in the Spectre Era (Extended Version)

Oreo: Protecting ASLR Against Microarchitectural Attacks (Extended Version)

Lightweight and Seamless Memory Randomization for Mission-Critical Services in a Cloud Platform

Preventing Rowhammer Exploits via Low-Cost Domain-Aware Memory Allocation

When malloc() Never Returns NULL -- Reliability as an Illusion

Efficient protection of kernel data structures via object partitioning