Hypervisor Execute-Only Memory Inhibits Code Rewriting

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Operating systems face risks when loading third-party executable modules, as these modules can potentially rewrite their own instructions in memory, leading to malicious behavior, especially since the OS manufacturer cannot guarantee their trustworthiness.

Innovation Solution

A hypervisor is used to create a virtual machine where the guest operating system can request specific memory ranges to be marked as execute-only access, preventing any attempts by executable modules to read or write to those areas, thereby inhibiting malicious code execution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If executable modules are allowed to load and execute freely in memory, then system functionality and adaptability are improved, but security and reliability deteriorate due to potential code rewriting attacks

Engineering Contradiction:

Improveability to load third-party executable modulesVSAvoidsecurity against malicious code execution

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent changes the memory access parameters by introducing execute-only memory regions. The hypervisor modifies the memory attributes of specific memory ranges to prohibit write access while maintaining execute permission, thereby preventing executable modules from rewriting their code in memory while still allowing them to execute

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The hypervisor acts as an intermediary between the guest operating system and the physical memory. It receives requests from the guest OS to mark memory regions as execute-only and enforces these restrictions at the hardware level, mediating between the need for executable module loading and the need to prevent malicious code rewriting

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If memory is marked as execute-only access, then security against code rewriting is improved, but flexibility in memory usage deteriorates

Engineering Contradiction:

Improveprotection against executable module attacksVSAvoidmemory access flexibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent applies execute-only memory attributes locally to specific memory ranges that contain executable code, rather than applying restrictions globally to all memory. This allows different parts of memory to have different access permissions, maintaining flexibility for data storage and code execution in other memory regions while providing security where needed

Inventive Principle:

Principle #3Local quality

3Reliability

If the hypervisor enforces execute-only memory access, then system security is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity enforcement capabilityVSAvoidhypervisor overhead

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system implements self-service by allowing the guest operating system itself to request and manage the execute-only memory markings for its own executable modules. The guest OS identifies which memory ranges should be protected and makes requests to the hypervisor, reducing the burden on the hypervisor to proactively manage security while maintaining strong security enforcement

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS11500550B2Inhibiting memory accesses to executable modules

Publication Date: 2022.11.15 RED HAT INC

AI summary

Inhibiting memory accesses to executable modules. A hypervisor executing on a computing host initiates a virtual machine comprising a guest operating system. The hypervisor receives a communication from the guest operating system requesting that a range of memory utilized by the guest operating system be identified as being execute-only access. The hypervisor marks at least one physical page of memory that includes the range of memory as being execute-only access.