Memory-corruption attacks such as code-reuse attacks and data-only attacks have been a key threat to systems security. To counter these threats, researchers have proposed a variety of defenses, including control-flow integrity (CFI), code-pointer integrity (CPI), and code (re-)randomization. All of them, to be effective, require a security primitive - intra-process protection of confidentiality and/or integrity for sensitive data (such as CFI's shadow stack and CPI's safe region).In this paper, we propose SEIMI, a highly efficient intra-process memory isolation technique for memory-corruption defenses to protect their sensitive data. The core of SEIMI is to use the efficient Supervisor-mode Access Prevention (SMAP), a hardware feature that is originally used for preventing the kernel from accessing the user space, to achieve intra-process memory isolation. To leverage SMAP, SEIMI creatively executes the user code in the privileged mode. In addition to enabling the new design of the SMAP-based memory isolation, we further develop multiple new techniques to ensure secure escalation of user code, e.g., using the descriptor caches to capture the potential segment operations and configuring the Virtual Machine Control Structure (VMCS) to invalidate the execution result of the control registers related operations. Extensive experimental results show that SEIMI outperforms existing isolation mechanisms, including both the Memory Protection Keys (MPK) based scheme and the Memory Protection Extensions (MPX) based scheme, while providing secure memory isolation.
|Original language||English (US)|
|Title of host publication||Proceedings - 2020 IEEE Symposium on Security and Privacy, SP 2020|
|Publisher||Institute of Electrical and Electronics Engineers Inc.|
|Number of pages||16|
|State||Published - May 2020|
|Event||41st IEEE Symposium on Security and Privacy, SP 2020 - San Francisco, United States|
Duration: May 18 2020 → May 21 2020
|Name||Proceedings - IEEE Symposium on Security and Privacy|
|Conference||41st IEEE Symposium on Security and Privacy, SP 2020|
|Period||5/18/20 → 5/21/20|
Bibliographical noteFunding Information:
We would like to thank the anonymous reviewers for their insightful suggestions and comments. This research was supported by the National Natural Science Foundation of China (NSFC) under grant U1736208, 61902374, U1636204, and U1836213. Chenggang Wu is the corresponding author (email@example.com). Yinqian Zhang is in part supported by a gift from Intel. Kangjie Lu was supported in part by the NSF awards CNS-1815621 and CNS-1931208. Any opinions, findings, conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of NSF. Min Yang is also a member of Shanghai Institute of Intelligent Electronics & Systems, Shanghai Institute for Advanced Communication and Data Science.