Undo Workarounds for Kernel Bugs
Undo Workarounds for Kernel Bugs
复制标题
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
S. Talebi;Zhihao Yao;A. A. Sani-A.;Zhiyun Qian;D. Austin
中科院分区：
文献类型：
--
作者：
S. Talebi;Zhihao Yao;A. A. Sani-A.;Zhiyun Qian;D. Austin
OS内核充满了错误，导致安全性，可靠性和可用性问题。最近已经开发了几种内核模糊器来找到这些错误并被证明是有效的。但是，发现虫子一旦被发现就需要几个月的时间才能修补。在这个脆弱性的窗口中，错误继续引起人们的关注。我们为核心错误提供了解决方法，称为Bowknots，即使触发错误，它们即使触发了系统的功能，也适用于许多核心错误，不会导致明显的性能开销，并且具有小的内核足迹。 Bowknots背后的关键思想是消除触发错误的机上SYSCALL的副作用，从而有效地中和Syscall。我们还提出了一个称为Hecaton的静态分析工具，该工具会自动生成弓箭并将其插入内核。通过对Android设备内核以及X86上游内核的广泛评估，我们证明了Bowknots可以有效缓解核虫和漏洞。我们还表明，Hecaton能够在大多数情况下完全自动产生正确的弓犬，并且需要分析师的其余部分最少的帮助。最后，我们通过消除重复的重新启动来证明弓箭在提高内核模糊效率方面的好处。
OS kernels are full of bugs resulting in security, reliability, and usability issues. Several kernel fuzzers have recently been developed to find these bugs and have proven to be effective. Yet, bugs take several months to be patched once they are discovered. In this window of vulnerability, bugs continue to pose concerns. We present workarounds for kernel bugs, called bowknots, which maintain the functionality of the system even when bugs are triggered, are applicable to many kernel bugs, do not cause noticeable performance overhead, and have a small kernel footprint. The key idea behind bowknots is to undo the side effects of the in-flight syscall that triggers a bug, effectively neutralizing the syscall. We also present a static analysis tool, called Hecaton, that generates bowknots automatically and inserts them into the kernel. Through extensive evaluations on the kernel of Android devices as well as x86 upstream kernels, we demonstrate that bowknots are effective in mitigating kernel bugs and vulnerabilities. We also show that Hecaton is capable of generating the right bowknots fully automatically in majority of cases, and requires minimal help from the analyst for the rest. Finally, we demonstrate the benefits of bowknots in improving the efficiency of kernel fuzzing by eliminating repetitive reboots.