Characterizing, exploiting, and detecting DMA code injection vulnerabilities in the presence of an IOMMU
| Autor: | Gil Kupfer, Adam Morrison, Dan Tsafrir, Markuze Alex, Boris Pismeny, Nadav Amit, Shay Vargaftik |
|---|---|
| Rok vydání: | 2021 |
| Předmět: |
Exploit
Computer science 020206 networking & telecommunications Linux kernel 02 engineering and technology computer.software_genre Memory management Control flow 020204 information systems Pointer (computer programming) 0202 electrical engineering electronic engineering information engineering Operating system Callback Code injection Direct memory access computer |
| Zdroj: | EuroSys |
| DOI: | 10.1145/3447786.3456249 |
| Popis: | Direct memory access (DMA) renders a system vulnerable to DMA attacks, in which I/O devices access memory regions not intended for their use. Hardware input-output memory management units (IOMMU) can be used to provide protection. However, an IOMMU cannot prevent all DMA attacks because it only restricts DMA at page-level granularity, leading to sub-page vulnerabilities. Current DMA attacks rely on simple situations in which write access to a kernel pointer is obtained due to sub-page vulnerabilities and all other attack ingredients are available and reside on the same page. We show that DMA vulnerabilities are a deep-rooted issue and it is often the kernel design that enables complex and multistage DMA attacks. This work presents a structured top-down approach to characterize, exploit, and detect them. To this end, we first categorize sub-page vulnerabilities into four types, providing insight into the structure of DMA vulnerabilities. We then identify a set of three vulnerability attributes that are sufficient to execute code injection attacks. We built analysis tools that detect these sub-page vulnerabilities and analyze the Linux kernel. We found that 72% of the device drivers expose callback pointers, which may be overwritten by a device to hijack the kernel control flow. Aided by our tools' output, we demonstrate novel code injection attacks on the Linux kernel; we refer to these as compound attacks. All previously reported attacks are single-step, with the vulnerability attributes present in a single page. In compound attacks, the vulnerability attributes are initially incomplete. However, we demonstrate that they can be obtained by carefully exploiting standard OS behavior. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|