Search

Commodity operating systems such as Windows, Linux, and MacOS X form the Trusted Computing Base (TCB) of today’s computing systems. However, since they are written in C and C++, they have memory safety errors and are vulnerable to kernel-level code reuse attacks. This paper presents IskiOS: a system that helps to thwart such attacks by providing both execute-only memory and an efficient shadow stack for operating system kernels on the x86 processor. Execute-only memory hides the code segment from buffer overread attacks, strengthening code randomization techniques. Shadow stacks protect return addresses from corruption. IskiOS leverages Intel’s Memory Protection Keys (MPK, a.k.a. PKU) and Kernel Page Table Isolation (KPTI) to protect kernel memory from buffer overwrite and overread attacks and to prevent corruption of the shadow stack. Unlike previous work, IskiOS places no restrictions on virtual address space layout, allowing the operating system to achieve higher diversification entropy by placing kernel stacks and kernel code in arbitrary locations within the virtual address space. IskiOS incurs virtually no performance overhead for execute-only memory. Its shadow stacks incur a geometric mean slowdown of 12.3% in our experiments.

As network, I/O, accelerator, and NVM devices capable of a million operations per second make their way into data centers, the software stack managing such devices has been shifting from implementations within the operating system kernel to more specialized kernel-bypass approaches. While the in-kernel approach guarantees both safety and fairness, it imposes too much overhead on microsecond-scale tasks. Kernel-bypass approaches improve throughput substantially but sacrifice safety and complicate resource management: if applications are mutually untrusting, then either each application must have exclusive access to its own device or else the device itself must implement resource management. This paper shows how to attain both safety and performance via intra-process isolation for multiple data plane libraries. Our protected libraries provide separate user-level protection domains for different services (e.g., network and in-memory database), with performance approaching that of unprotected kernel bypass. We explore two concrete implementations of protected libraries. The first uses Intel's VM functions (VMFUNC) mechanism to switch between pre-established address spaces without entering the kernel. The second uses the mechanism of memory protection keys (Intel's PKU) to change the permissions associated with subsets of a single address space. We show that these approaches can efficiently protect high-throughput in-memory databases and user-space network stacks. The PKU approach incurs less than 10% protection cost at up to 2.3 million library switches per second per core. The VMFUNC approach is more expensive, but, it eliminates the need to inspect program binaries and offers stronger protection against speculative side-channel data leaks. Both approaches significantly outperform kernel-level protection or system call switching of user-level address spaces.