Selective Kernel User Space Patching via Page Fault Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional patching systems apply updates to all user space application objects regardless of usage, leading to inefficient resource utilization and high processing loads, as they do not differentiate between frequently and rarely used functions.
Innovation Solution
A selective patching method that identifies and prioritizes patching of functions based on kernel and user space interaction, marking non-executable pages associated with rarely used functions until a page fault occurs, thereby reducing unnecessary resource allocation and processing loads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If patches are applied to all user space application objects regardless of usage, then security vulnerabilities are addressed comprehensively, but processing loads and resource consumption increase significantly
Solution Approach 1:
The patent implements selective patching where only the specific function requiring security updates is patched, rather than applying patches to all functions. This is achieved by identifying the vulnerable function, locating its code in the executable object, and applying the patch only to that specific code segment, thereby reducing unnecessary processing while maintaining security for the critical vulnerable function.
2Reliability
If patches are applied to all functions in an application, then all security vulnerabilities are cured, but resources are wasted on rarely used functions
Solution Approach 1:
The patent applies local quality by making the patching action selective and localized to only the specific function that contains the security vulnerability. The system identifies the vulnerable function's location within the executable object and applies the patch only to that local region, rather than globally patching the entire application, thus conserving resources while maintaining security where needed.
3Reliability
If comprehensive patching is performed on all application objects, then security is enhanced, but the time required for patching increases
Solution Approach 1:
The patent employs preliminary action by first identifying and locating the specific vulnerable function within the executable object before applying the patch. The system uses the vulnerable function's identifier to search and locate its code section in advance, preparing the precise target for patching. This preliminary localization significantly reduces the time required compared to searching and patching all functions, while ensuring the critical security fix is applied.
Data Source
AI summary
Disclosed herein are systems and methods for selective patching processes. In one exemplary aspect, the method includes: identifying, via a user space patching service, a patch that modifies at least one function included in a process, wherein the process is executed on a computing device; generating a list of target pages in virtual memory of the computing device, wherein the list of target pages includes code associated with the at least one function; marking the target pages as non-executable based on file identification; intercepting, using an amended page-fault event handler, an attempt to execute the code associated with the at least one function by the process; and applying the patch to modify the at least one function.