论文标题
Adelie：Linux驱动程序的连续地址空间布局重新随机化
Adelie: Continuous Address Space Layout Re-randomization for Linux Drivers
论文作者
论文摘要
尽管已对用户空间程序进行了广泛研究地址空间布局随机化（ASLR），但相应的OS内核的KASLR支持仍然非常有限，这使得内核容易受到正式（JIT）返回为导向的编程（ROP）攻击的攻击。此外，由于建筑约束，诸如Linux之类的商品OSS将其KASLR范围限制在32位（例如，X86-64仅支持大多数指令的32位立即操作数），这使它们容易受到较低的野性野性野蛮的rop攻击，因此由于低熵而造成了攻击。大多数内核指针仍然保持静态，当指针被泄漏时加剧了问题。 我们的内核防御机制Adelie克服了KASLR的限制，增加了KASLR熵，并成功地对Linux内核进行了成功的ROP攻击。首先，Adelie可以启用与位置无关的代码（PIC）模型，以便可以将内核及其模块放置在64位虚拟地址空间中的任何位置，彼此之间的任何距离。其次，Adelie在模块上实现了堆栈的重新传输和地址加密。最后，Adelie通过使用PIC模型使其（几乎）无法通过这些模块注入ROP小工具来实现有效的连续KASLR，无论小工具的起源如何。 由于设备驱动程序（通常为模块编译）通常由第三方开发，并且通常比Core OS零件的测试较少，因此它们通常也更脆弱。通过完全重新交流的设备驱动程序，最后两个贡献共同防止了大多数JIT ROP攻击，因为脆弱的模块很可能是攻击的起点。此外，虚拟化环境中的某些操作系统实例被专门指定为运行设备驱动程序，在该设备驱动程序中，驱动程序是JIT ROP攻击的主要目标。我们的评估表明，阿德莉的方法效率很高。 [完整的摘要是在论文中]
While address space layout randomization (ASLR) has been extensively studied for user-space programs, the corresponding OS kernel's KASLR support remains very limited, making the kernel vulnerable to just-in-time (JIT) return-oriented programming (ROP) attacks. Furthermore, commodity OSs such as Linux restrict their KASLR range to 32 bits due to architectural constraints (e.g., x86-64 only supports 32-bit immediate operands for most instructions), which makes them vulnerable to even unsophisticated brute-force ROP attacks due to low entropy. Most in-kernel pointers remain static, exacerbating the problem when pointers are leaked. Adelie, our kernel defense mechanism, overcomes KASLR limitations, increases KASLR entropy, and makes successful ROP attacks on the Linux kernel much harder to achieve. First, Adelie enables the position-independent code (PIC) model so that the kernel and its modules can be placed anywhere in the 64-bit virtual address space, at any distance apart from each other. Second, Adelie implements stack re-randomization and address encryption on modules. Finally, Adelie enables efficient continuous KASLR for modules by using the PIC model to make it (almost) impossible to inject ROP gadgets through these modules regardless of gadget's origin. Since device drivers (typically compiled as modules) are often developed by third parties and are typically less tested than core OS parts, they are also often more vulnerable. By fully re-randomizing device drivers, the last two contributions together prevent most JIT ROP attacks since vulnerable modules are very likely to be a starting point of an attack. Furthermore, some OS instances in virtualized environments are specifically designated to run device drivers, where drivers are the primary target of JIT ROP attacks. Our evaluation shows high efficiency of Adelie's approach. [full abstract is in the paper]
