基于eBPF的内核堆漏洞动态缓解机制  

Dynamic Mitigation Solution Based on eBPF Against Kernel Heap Vulnerabilities

作　　者：王子成 郭迎港 钟炳南 陈越琦 曾庆凯[1,2] WANG Zi-Cheng;GUO Ying-Gang;ZHONG Bing-Nan;CHEN Yue-Qi;ZENG Qing-Kai(State Key Laboratory for Novel Software Technology(Nanjing University),Nanjing 210023,China;Department of Computer Science and Technology,Nanjing University,Nanjing 210023,China;Department of Computer Science,University of Colorado Boulder,Boulder 80309,USA)

机构地区：[1]计算机软件新技术国家重点实验室(南京大学),江苏南京210023 [2]南京大学计算机科学与技术系,江苏南京210023 [3]Department of Computer Science,University of Colorado Boulder,Boulder 80309,USA

出　　处：《软件学报》2024年第7期3332-3354,共23页Journal of Software

基　　金：国家自然科学基金(61772266,61431008)。

摘　　要：内核堆漏洞是目前操作系统安全的主要威胁之一,用户层攻击者通过触发漏洞能够泄露或修改内核敏感信息,破坏内核控制流,甚至获取root权限.但是由于漏洞的数量和复杂性剧增,从漏洞首次被报告到开发者给出修复补丁(patch)往往需要较长时间,而内核现阶段采用的缓解机制均能被稳定绕过.为此提出一种基于eBPF的内核堆漏洞动态缓解框架,用于在修复时间窗口中降低内核安全风险.动态缓解框架采取数据对象空间随机化策略,在每次分配时为漏洞报告中涉及的数据对象分配随机地址,并充分利用eBPF的动态、安全特性将空间随机化对象在运行时注入内核,使得攻击者无法准确放置攻击负载,堆漏洞几乎无法被利用.评估40个真实内核堆漏洞,并收集12个绕过现有缓解机制的攻击程序进行进一步分析和实验,证实动态缓解框架提供充足的安全性.性能测试表明,即使在严苛情况下,大量分配的4类数据对象仅对系统造成约1%的性能损耗和可以忽略不计的内存损耗,同时增加保护对象的数量几乎不引入额外性能损耗.所提机制对比相关工作适用范围更广,安全性更强,而且无需安全专家发布的漏洞补丁,可以根据漏洞报告生成缓解程序,具备广阔应用前景.Kernel heap vulnerability is currently one of the main threats to operating system security.User-space attackers can leak or modify sensitive kernel information,disrupt kernel control flow,and even gain root privilege by triggering a vulnerability.However,due to the rapid increase in the number and complexity of vulnerabilities,it often takes a long time from when a vulnerability is first reported to when the developer issues a patch,and kernel mitigation mechanisms currently adopted are usually steadily bypassed.Therefore,this study proposes an eBPF-based dynamic mitigation framework for kernel heap vulnerabilities,so as to reduce kernel security risks during the time window fixing.The framework adopts data object space randomization to assign random addresses to the data objects involved in vulnerability reports at each allocation.In addition,it takes full advantage of the dynamic and secure features of eBPF to inject space-randomized objects into the kernel during runtime,so the attacker cannot place any attack payload accurately,and the heap vulnerabilities are almost unexploitable.This study evaluates 40 real kernel heap vulnerabilities and collects 12 attacks that bypass the existing mitigation mechanisms for further analysis and tests.As a result,it verifies that the dynamic mitigation framework provides sufficient security.Performance tests show that even under severe conditions,the four types of data objects only cause performance loss of about 1%and negligible memory loss to the system,and there is almost no additional performance loss when the number of protected objects increases.Compared with related work,the mechanism in this study has a wider scope of application and stronger security,and it does not require vulnerability patches issued by security experts.Furthermore,it can generate mitigation procedures according to vulnerability reports and has a broad application prospect.

关 键 词：系统安全 漏洞缓解 eBPF 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]