Kernel Page Table Execution Without Read Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing techniques are inadequate in effectively protecting operating system kernels from sniff-and-code reuse exploits, which allow attackers to execute code snippets in a controlled order, posing a significant security threat.

Innovation Solution

Initializing a kernel mode page table by setting kernel page entries from supervisor mode to user mode and enabling supervisor mode access prevention, allowing code execution while preventing direct access and reading, thus thwarting attacks like return-oriented programming and sniff-and-code reuse.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If kernel page entries are made accessible and readable in supervisor mode, then code execution is enabled, but security against sniff-and-code reuse attacks is compromised

Engineering Contradiction:

Improvekernel securityVSAvoidcode reuse exploit vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent inverts the traditional memory access model by making kernel pages inaccessible in supervisor mode while still allowing execution. Instead of allowing both read and execute access, it permits only execute access through a specialized mechanism, thereby preventing code reuse attacks while maintaining functionality.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent changes the memory protection parameters by setting the supervisor mode access bit to 0 for kernel pages, while maintaining execute permission. This parameter change allows the system to distinguish between read access (which is blocked) and execute access (which is permitted through the execution mechanism).

Inventive Principle:

Principle #35Parameter changes

2Ease of operation

If supervisor mode access is enabled for kernel pages, then full access and execution are permitted, but susceptibility to return-oriented programming attacks increases

Engineering Contradiction:

Improvekernel access capabilityVSAvoidreturn-oriented programming attack surface

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent applies the inversion principle by reversing the traditional access model. Instead of allowing full supervisor mode access for both reading and executing, it blocks read access while maintaining execute capability through a specialized execution mechanism, thereby eliminating the attack surface for return-oriented programming while preserving operational functionality.

Inventive Principle:

Principle #13The other way round (Inversion)

3Productivity

If kernel mode page table is configured with traditional s-pages, then direct access is allowed, but code reuse and sniff attacks can succeed

Engineering Contradiction:

Improveexecution efficiencyVSAvoidprotection against code reuse exploits

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent inverts the traditional page configuration by creating u-pages that are inaccessible in supervisor mode yet executable. This inversion allows the system to maintain execution efficiency while blocking the ability of attackers to read and reuse code snippets, thereby resolving the contradiction between productivity and security.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS11995178B2Protection of kernel from code reuse attacks

Publication Date: 2024.05.28 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Protection of a kernel from a sniff and code reuse attack. A kernel mode page table in initialized in a kernel. The kernel page entries in the kernel mode page table are set from s-pages to u-pages. Supervisor mode access prevention is enabled in the u-pages. Code contained in the kernel page entries in the u-pages is executed, the kernel page entries in the u-pages are capable of execution but are not capable of being accessed and read directly.