Analyzing and improving Linux kernel memory protection: A model checking approach

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2010, Pages 271-280

  Liakh, Siarhei ^a   Grace, Michael ^a   Jiang, Xuxian ^a  

^a NORTH CAROLINA STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CODES (SYMBOLS); LINUX;

'CURRENT; ABSTRACT MODELING; CODE INJECTION; DESIGN AND IMPLEMENTATIONS; KERNEL DESIGN; KERNEL MEMORY; LINUX KERNEL; MEMORY PROTECTION; MODELS CHECKING; PROPERTY;

MODEL CHECKING;

EID: 78751497274     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1920261.1920301     Document Type: Conference Paper

References (34)

1. A Look at ftrace. http://lwn.net/Articles/322666/.
2. Advanced Micro Devices. AMD64 Architecture Programmera̧ŕs Manual Volume 2: System Programming, 3.14 edition, September 2007.
3. E. G. Barrantes, D. H. Ackley, S. Forrest, T. S. Palmer, D. Stefanovic, and D. D. Zovi. Randomized Instruction Set Emulation to Disrupt Binary Code Injection Attacks. In CCS '03: Proceedings of the 10th ACM Computer and Communications Security Conference, 2003.
4. T. C. Block. Standard BIOS 32-bit Service Directory Proposal. Phoenix Technologies Ltd., 0.4 edition, June 1993.
5. D. Bovet and M. Cesati. Understanding The Linux Kernel. Oreilly & Associates Inc, third edition, 2005.
6. C. Cadar, D. Dunbar, and D. Engler. KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs. In OSDI'08: Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation, Dec. 2008.
7. H. Chen and D. Wagner. MOPS: An Infrastructure for Examining Security Properties of Software. In CCS'02: Proceedings of the 9th ACM Conference on Computer and Communications Security, 2002.
8. H. Chen, D. Wagner, and D. Dean. Setuid Demystified. In Security '02: Proceedings of the 11th Conference on USENIX Security Symposium, 2002.
9. I. Corporation. IA-32 Intel Architecture Software Developer's Manual Volume 3A: System Programming Guide, Part 1. Intel Corp., 2006. Publication number 253668.
10. D. L. Dill. The Murphi Verification System. http://eprints.kfupm.edu.sa/ 70602/1/70602.pdf, 1996.
11. J. Franklin, A. Seshadri, N. Qu, S. Chaki, and A. Datta. Attacking, Repairing, and Verifying SecVisor: A Retrospective on the Security of a Hypervisor Research Area. Technical report, June 2008.
12. T. Garfinkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Terra: A Virtual Machine-Based Platform for Trusted Computing. In SOSP '03: Proceedings of the 19th Symposium on Operating System Principles, October 2003.
13. M. Gorman. Understanding The Linux Virtual Memory Manager. Prentice Hall, May 2004.
14. R. Hund, T. Holz, and F. Freiling. Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms. In Security '09: Proceedings of the 18th Conference on USENIX Security Symposium. USENIX Association, 2009.
15. G. S. Kc, A. D. Keromytis, and V. Prevelakis. Countering Code-Injection Attacks With Instruction-Set Randomization. In CCS '03: Proceedings of the 10th ACM Computer and Communications Security Conference, 2003.
16. The Linux Kernel Archives. http://www.kernel.org.
17. S. Liakh and X. Jiang. [1/4,tip:x86/mm] correcting improper large page preservation. https://patchwork.kernel.org/patch/90045/, 2010.
18. S. Liakh and X. Jiang. [2/4,tip:x86/mm] set first mb as rw+nx. https://patchwork.kernel.org/patch/90048/, 2010.
19. S. Liakh and X. Jiang. [3/4,tip:x86/mm] nx protection for kernel data. https://patchwork.kernel.org/patch/90046/, 2010.
20. S. Liakh and X. Jiang. [4/4,tip:x86/mm] ro/nx protection for loadable kernel modules. https://patchwork.kernel.org/patch/90047/, 2010.
21. E. P. M. Michalis Polychronakis, Kostas G. Anagnostakis. An Empirical Study of Real-world Polymorphic Code Injection Attacks. In LEET '09: Proceedings of the 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats. Usenix Association, April 2009.
22. J. Mitchell, V. Shmatikov, and U. Stern. Finite-State Analysis of SSL 3.0. In Security '98: Proceedings of the 7th Conference on USENIX Security Symposium, 1998.
23. A. Nayani, M. Gorman, and R. S. de Castro. Memory Management in Linux - Desktop Companion to the Linux Source Code. http://www.ecsl.cs.sunysb.edu/ elibrary/linux/mm/mm.pdf, May 2002.
24. PaX ASLR. http://pax.grsecurity.net/docs/aslr.txt.
25. PaX NOEXEC. http://pax.grsecurity.net/docs/noexec.txt.
26. PCI Special Interest Group. PCI BIOS Specification, 2.1 edition, August 1994.
27. S. Pearson. Trusted Computing Platforms, the Next Security Solution. Technical report, HP Laboratories, November 2002.
28. R. Riley, X. Jiang, and D. Xu. Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing. In RAID '08: Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection. Springer-Verlag, 2008.
29. B. Schwarz, H. Chen, D. Wagner, G. Morrison, J. West, J. Lin, and W. Tu. Model Checking An Entire Linux Distribution for Security Violations. In ACSAC'05: Proceedings of the 21st Annual Computer Security Applications Conference, 2005.
30. A. Seshadri, M. Luk, N. Qu, and A. Perrig. Secvisor: A tiny hypervisor to provide lifetime kernel code integrity for commodity oses. In SOSP '07: Proceedings of the 21st ACM SIGOPS symposium on Operating systems principles. ACM, 2007.
31. J. Tombs, B. Smith, R. Grehan, T. Yager, D. C. Niemi, and I. Smith. Unixbench-5.1.2. http://code.google.com/p/byte-unixbench/.
32. Ubuntu. http://www.ubuntu.com/.
33. A. van de Ven. Limiting Buffer Overflows with ExecShield. Red Hat Magazine, July 2005.
34. J. Yang, P. Twohey, D. Engler, and M. Musuvathi. Using Model Checking to Find Serious File System Errors. In OSDI'04: Proceedings of the 6th USENIX Symposium on Operating Systems Design and Implementation, 2004.