Skip to main content

Comprehensive and efficient protection of kernel control data

Publication ,  Journal Article
Li, J; Wang, Z; Bletsch, T; Srinivasan, D; Grace, M; Jiang, X
Published in: IEEE Transactions on Information Forensics and Security
December 1, 2011

Protecting kernel control data (e.g., function pointers and return addresses) has been a serious issue plaguing rootkit defenders. In particular, rootkit authors only need to compromise one piece of control data to launch their attacks, while defenders need to protect thousands of such values widely scattered across kernel memory space. Worse, some of this data (e.g., return addresses) is volatile and can be dynamically generated at run time. Existing solutions, however, offer either incomplete protection or excessive performance overhead. To overcome these limitations, we present indexed hooks, a scheme that greatly facilitates kernel control-flow enforcement by thoroughly transforming and restricting kernel control data to take only legal jump targets (allowed by the kernel's control-flow graph). By doing so, we can severely limit the attackers' possibility of exploiting them as an infection vector to launch rootkit attacks. To validate our approach, we have developed a compiler-based prototype that implements this technique in the FreeBSD 8.0 kernel, transforming 49025 control transfer instructions ($\sim$ 7.25% of the code base) to use indexed hooks instead of direct pointers. Our evaluation results indicate that our approach is generic, effective, and can be implemented on commodity hardware with a low performance overhead ($<$5% based on benchmarks). © 2006 IEEE.

Duke Scholars

Altmetric Attention Stats
Dimensions Citation Stats

Published In

IEEE Transactions on Information Forensics and Security

DOI

ISSN

1556-6013

Publication Date

December 1, 2011

Volume

6

Issue

4

Start / End Page

1404 / 1417

Related Subject Headings

  • Strategic, Defence & Security Studies
  • 46 Information and computing sciences
  • 40 Engineering
  • 09 Engineering
  • 08 Information and Computing Sciences
 

Citation

APA
Chicago
ICMJE
MLA
NLM
Li, J., Wang, Z., Bletsch, T., Srinivasan, D., Grace, M., & Jiang, X. (2011). Comprehensive and efficient protection of kernel control data. IEEE Transactions on Information Forensics and Security, 6(4), 1404–1417. https://doi.org/10.1109/TIFS.2011.2159712
Li, J., Z. Wang, T. Bletsch, D. Srinivasan, M. Grace, and X. Jiang. “Comprehensive and efficient protection of kernel control data.” IEEE Transactions on Information Forensics and Security 6, no. 4 (December 1, 2011): 1404–17. https://doi.org/10.1109/TIFS.2011.2159712.
Li J, Wang Z, Bletsch T, Srinivasan D, Grace M, Jiang X. Comprehensive and efficient protection of kernel control data. IEEE Transactions on Information Forensics and Security. 2011 Dec 1;6(4):1404–17.
Li, J., et al. “Comprehensive and efficient protection of kernel control data.” IEEE Transactions on Information Forensics and Security, vol. 6, no. 4, Dec. 2011, pp. 1404–17. Scopus, doi:10.1109/TIFS.2011.2159712.
Li J, Wang Z, Bletsch T, Srinivasan D, Grace M, Jiang X. Comprehensive and efficient protection of kernel control data. IEEE Transactions on Information Forensics and Security. 2011 Dec 1;6(4):1404–1417.

Published In

IEEE Transactions on Information Forensics and Security

DOI

ISSN

1556-6013

Publication Date

December 1, 2011

Volume

6

Issue

4

Start / End Page

1404 / 1417

Related Subject Headings

  • Strategic, Defence & Security Studies
  • 46 Information and computing sciences
  • 40 Engineering
  • 09 Engineering
  • 08 Information and Computing Sciences