C2C: Fine-grained Configuration-driven System Call Filtering
C2C: Fine-grained Configuration-driven System Call Filtering
复制标题
DOI：
10.1145/3548606.3559366
复制
发表时间：
2022-11
期刊：
影响因子：
--
通讯作者：
Seyedhamed Ghavamnia;Tapti Palit;M. Polychronakis
中科院分区：
文献类型：
--
作者：
Seyedhamed Ghavamnia;Tapti Palit;M. Polychronakis
配置选项允许用户根据所需的要求自定义应用程序功能。尽管从未执行与禁用功能相对应的代码，但它仍然存在于过程内存中，并包括应用程序攻击表面的一部分，例如，它可以重复用于构建利用代码。因此，根据给定配置自动降低残疾应用功能的攻击表面是理想的防御能力。然而，现代软件设计的复杂性以及流行的编程语言的复杂性在自动将配置选项映射到其相应的应用程序代码中引入了重大挑战。在本文中，我们提出了配置对代码（C2C），这是一种通用配置驱动的攻击表面减少技术，使用静态代码分析和仪器自动将配置选项映射到应用程序代码。 C2C通过在控制流程图中修剪依赖于配置的条件分支在细粒度级别运行，从而可以在基本块级别准确地识别给定配置选项的代码。在运行时，C2C通过过滤禁用功能仅要求的任何系统调用来减少应用程序的攻击表面。使用流行的应用程序，我们展示了在不需要的情况下如何自动禁用安全系统调用（例如执行），从而限制了攻击者的脆弱性利用功能。系统调用过滤还减少了基础Linux内核的裸露攻击表面，与以前的软件专业技术相比，中和32个CVE（总计88）。
Configuration options allow users to customize application features according to the desired requirements. While the code that corresponds to disabled features is never executed, it still resides in process memory and comprises part of the application's attack surface, e.g., it can be reused for the construction of exploit code. Automatically reducing the attack surface of disabled application features according to a given configuration is thus a desirable defense-in-depth capability. The intricacies of modern software design and the complexities of popular programming languages, however, introduce significant challenges in automatically deriving the mapping of configuration options to their corresponding application code. In this paper, we present Configuration-to-Code (C2C), a generic configuration-driven attack surface reduction technique that automatically maps configuration options to application code using static code analysis and instrumentation. C2C operates at a fine-grained level by pruning configuration-dependent conditional branches in the control flow graph, allowing the precise identification of a given configuration option's code at the basic block level. At runtime, C2C reduces the application's attack surface by filtering any system calls required exclusively by disabled features. Using popular applications, we show how security-critical system calls (such as execve) can be automatically disabled when not needed, limiting an attacker's vulnerability exploitation capabilities. System call filtering also reduces the exposed attack surface of the underlying Linux kernel, neutralizing 32 additional CVEs (for a total of 88) compared to previous software specialization techniques.