Detecting code injection attacks at TLB miss

다국어 초록 (Multilingual Abstract)

This paper presents a user transparent protection against binary code injection attacks. Code injection is a major vehicle for carrying out software attacks. Using the TLB (Translation Lookahead Buffer) that is usually split between data (D-TLB) and instructions (I-TLB) as found in modern processors, a simple protection can be developed based on an observation that activating an injected code causes I-TLB miss for a memory page modified by code injection. If program execution from a modified page is disallowed, injected code cannot start. However, such protection is of limited use unless the protection can handle legitimate runtime generated codes, which would trigger false-alarms due to the same translation trace as that of code injection attacks. Modern systems often utilize runtime-generated code for extensibility and flexibility. In order to prevent such false-alarms, the presented protection identifies the source of the code injected – from external I/O or not and refers to the privilege level of the process at runtime. This paper introduces a scheme that determines whether the code injected is legitimate. By identifying memory pages modified by external I/O operations, the scheme provides software transparent data execution prevention in processors with and without NX-bit support. The experimental results show that the proposed protection can detect all the code injection attacks tested on the two Linux operating systems out of the box and that the performance impact incurred by this protection is insignificant.

목차 (Table of Contents)

• 1 Introduction 1
• 2 Background 5
• 2.1 Code Injection Attack 5
• 2.2 Related Works 6
• 2.3 Address Translation and TLB 13
• 3 TLB Monitor 18
• 3.1 Basic Idea 18
• 3.2 Legitimate Code Injection 23
• 3.3 Missing TLB entries 26
• 3.4 With NX-bit support 28
• 4 Evaluation 31
• 4.1 Evaluation of the TLB-Mon's the Efficacy 31
• 4.1.1 Simulation Environment 32
• 4.1.2 Simulation Results 34
• 4.2 Evaluation of the TLB-Mon's the Performance Impact 37
• 4.2.1 Performance Factors 37
• 4.2.2 Performance Impact 39
• 5 Discussion 42
• 6 Conclusion 47
• A Testing and Evaluation of TLB-Mon with bochs 50