Abstract:Container isolation is implemented through OS-level virtualization, such as Linux namespaces. Unfortunately, these mechanisms are extremely challenging to implement correctly and, in practice, suffer from functional interference bugs, which compromise container security. In particular, functional interference bugs allow an attacker to extract information from another container running on the same machine or impact its integrity by modifying kernel resources that are incorrectly isolated. Despite their impact, functional interference bugs in OS-level virtualization have received limited attention in part due to the challenges in detecting them. Instead of causing memory errors or crashes, many functional interference bugs involve hard-to-catch logic errors that silently produce semantically incorrect results. This paper proposes KIT, a dynamic testing framework that discovers functional interference bugs in OS-level virtualization mechanisms, such as Linux namespaces. The key idea of KIT is to detect inter-container functional interference by comparing the system call traces of a container across two executions, where it runs with and without the preceding execution of another container. To achieve high efficiency and accuracy, KIT includes two critical components: an efficient algorithm to generate test cases that exercise inter-container data flows and a system call trace analysis framework that detects functional interference bugs and clusters bug reports. KIT discovered 9 functional interference bugs in Linux kernel 5.13, of which 6 have been confirmed. All bugs are caused by logic errors, showing that this approach is able to detect hard-to-catch semantic bugs.

One Simple API Can Cause Hundreds of Bugs An Analysis of Refcounting Bugs in All Modern Linux Kernels

Kernel Refcount Bug Detection Based on the Consistency of Error Path Behavior

Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking

RID: Finding Reference Count Bugs with Inconsistent Path Pair Checking.

Characterizing Common and Domain-Specific Package Bugs: A Case Study on Ubuntu.

Refcount Field Identification for Linux Kernel Based on Deep Learning

Understanding Vulnerability Inducing Commits of the Linux Kernel

An Empirical Study of Regression Bug Chains in Linux

An Empirical Study of Bugs in Build Process

An Empirical Study of Refactoring Engine Bugs

An Empirical Study on API-Misuse Bugs in Open-Source C Programs

Hawkeye: Eliminating Kernel Address Leakage in Normal Data Flows

FREEWILL: Automatically Diagnosing Use-after-free Bugs via Reference Miscounting Detection on Binaries

UBITect: a precise and scalable method to detect use-before-initialization bugs in Linux kernel

Towards Understanding Tool-chain Bugs in the LLVM Compiler Infrastructure.

Detecting API Post-Handling Bugs Using Code and Description in Patches

How Well Industry-Level Cause Bisection Works in Real-World: A Study on Linux Kernel

An Empirical Study on Real Bug Fixes

MEBS: Uncovering Memory Life-Cycle Bugs in Operating System Kernels

AntMiner: Mining More Bugs by Reducing Noise Interference

KIT: Testing OS-Level Virtualization for Functional Interference Bugs