Instruction Filters for Mitigating Attacks on Instruction Emulation in Hypervisors
Instruction Filters for Mitigating Attacks on Instruction Emulation in Hypervisors
复制标题
DOI：
10.1587/transinf.2019edp7186
复制
发表时间：
2020-07
期刊：
影响因子：
--
通讯作者：
Ken-Ichi Ishiguro;K. Kono
中科院分区：
文献类型：
--
作者：
Ken-Ichi Ishiguro;K. Kono
摘要管理程序中的漏洞在多租户云中至关重要，对攻击者具有吸引力，因为管理程序中的漏洞可能会破坏所有虚拟机(VM)安全。本文主要研究管理程序内部指令仿真器中的漏洞。指令模拟器中的漏洞并不少见；CVE-2017-2583、CVE-2016-9756、CVE-2015-0239、CVE-2014-3647等等。为了向后兼容旧式x86 CPU，传统的管理程序可以随时根据请求模拟任意指令。这种设计导致了一个很大的攻击面，使得很难消除模拟器中的漏洞。本文提出了FWinst，它缩小了仿真器中针对漏洞的攻击面。FWinst背后的关键见解是，仿真器应该只仿真一小部分指令，这取决于底层的CPU微体系结构和管理程序的fi配置。FWinst识别在其中调用指令仿真器的仿真上下文，并标识fi允许在当前上下文中仿真的合法指令子集。通过fi删除非法指令，fwinst缩小了攻击面。特别是，FWinst在最近的x86微体系结构上是有效的，因为合法的子集变得非常小。我们的实验结果表明，FWinst防止了仿真器中的现有漏洞在Westmel和Skylake微体系结构上被利用，并且运行时开销可以忽略不计。
SUMMARY Vulnerabilities in hypervisors are crucial in multi-tenant clouds and attractive for attackers because a vulnerability in the hypervisor can undermine all the virtual machine (VM) security. This paper focuses on vulnerabilities in instruction emulators inside hypervisors. Vulnerabilities in instruction emulators are not rare; CVE-2017-2583, CVE-2016-9756, CVE-2015-0239, CVE-2014-3647, to name a few. For backward compatibility with legacy x86 CPUs, conventional hypervisors emulate arbitrary instructions at any time if requested. This design leads to a large attack surface, making it hard to get rid of vulnerabilities in the emulator. This paper proposes FWinst that narrows the attack surface against vulnerabilities in the emulator. The key insight behind FWinst is that the emulator should emulate only a small subset of instructions, depending on the underlying CPU micro-architecture and the hypervisor configuration. FWinst recognizes emulation contexts in which the instruction emulator is invoked, and identifies a legitimate subset of instructions that are allowed to be emulated in the current context. By filtering out illegitimate instructions, FWinst narrows the attack surface. In particular, FWinst is e ff ective on recent x86 micro-architectures because the legitimate subset becomes very small. Our experimental results demonstrate FWinst prevents existing vulnerabilities in the emulator from being exploited on Westmere and Skylake micro-architectures, and the runtime overhead is negligible.