Kernel Runtime Randomization for ROP-Resistant Memory Layouts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing devices, particularly those using the Linux kernel, are vulnerable to attacks like return oriented programming (ROP) due to predictable memory layouts, which can be exploited by attackers to gain root access, and existing randomization techniques like KASLR have vulnerabilities.
Innovation Solution
Implementing runtime randomization by randomly rearranging and relocating relocatable objects within the kernel's memory layout, using a randomization image to generate a randomized runtime program, ensuring unpredictable memory locations for these objects, and updating relocation tables to maintain security without storing the randomized program on non-volatile storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the kernel uses a fixed memory layout for loading and execution, then the kernel can be loaded and executed efficiently with predictable addresses, but the kernel becomes vulnerable to attacks such as return oriented programming (ROP) that exploit knowledge of function and data locations
Solution Approach 1:
The patent implements runtime randomization that dynamically changes the memory layout of the kernel each time it is loaded. The base address of the kernel image is randomized, and all function and data addresses are adjusted accordingly during runtime. This dynamic transformation ensures that even if an attacker gains knowledge of the memory layout at one point in time, it becomes invalid after the next kernel load, thereby preventing ROP attacks while maintaining execution efficiency.
Solution Approach 2:
The patent changes the parameter of the kernel's base address from a fixed value to a randomized value at runtime. By modifying the base address parameter and subsequently adjusting all relative addresses of functions and data structures, the system achieves security through parameter transformation without fundamentally changing the kernel's loading and execution mechanism.
2Reliability
If kernel address space layout randomization (KASLR) is used to randomize the base address of the kernel image, then attack difficulty increases, but attackers can still compromise the kernel by obtaining the address of a single function through data leakage during startup or execution
Solution Approach 1:
The patent extends the static base address randomization of KASLR to full runtime randomization. Instead of only randomizing the base address, the system continuously randomizes the positions of all kernel functions and data structures during execution. This dynamic approach ensures that even if an attacker leaks one address, all other addresses remain unpredictable and change over time, eliminating the vulnerability to single-function exploitation.
Solution Approach 2:
The patent performs comprehensive address randomization before any kernel functions are executed or data is exposed. By establishing the randomized memory layout in advance during the loading process, the system prevents attackers from obtaining useful information through data leakage, as all addresses are already randomized and will change with each kernel load.
3Productivity
If relocatable objects are placed at fixed locations in the kernel image, then the kernel can be linked and loaded efficiently, but attackers can exploit knowledge of these fixed locations to compromise the runtime program
Solution Approach 1:
The patent maintains efficient kernel loading by using a standardized linked executable image format with fixed structures during the linking phase. However, at runtime, the system dynamically randomizes the positions of all relocatable objects (functions, data structures) within the loaded kernel image. This separation of static linking efficiency and dynamic runtime security allows the system to benefit from both approaches without compromise.
Solution Approach 2:
The patent performs the randomization of relocatable objects as a preliminary action during the kernel loading process, before any execution or data exposure occurs. By establishing randomized positions in advance and updating all internal references accordingly, the system ensures that attackers cannot exploit fixed location knowledge, while the loading process itself remains efficient due to the prepared randomization scheme.
Data Source
AI summary
An apparatus includes a processor coupled to a non-volatile memory and a runtime memory. The processor is configured to read, from the non-volatile memory, a linked executable image and a randomization image. The linked executable image includes a linked executable program, and the randomization image includes one or more of a symbol table, a relocation table, and an object table. The processor loads the linked executable image to generate a runtime program, performs a runtime randomization to generate a randomized runtime program, and executes the randomized runtime program. The runtime randomization includes: copying a segment of the runtime program to a temporary location, wherein the copied segment comprises a plurality of relocatable objects; generating a randomized runtime program by writing each relocatable object into the runtime program based on a random ordering of the plurality of relocatable objects; and performing relocations for the randomized runtime program.