TC: Small: Collaborative Research:Protecting Commodity Operating Systems From Vulnerable Device Drivers

在商用操作系统中，设备驱动程序占代码的很大一部分。Windows XP有超过35000个驱动程序，超过112,000个版本，而Linux内核的540万行代码中有超过310万行是设备驱动程序代码。正如最近针对设备驱动程序的几个漏洞所显示的那样，驱动程序中充斥着危及系统安全性的错误。利用设备驱动程序是危险的，因为商品操作系统在内核地址空间中执行驱动程序。被破坏的驱动程序可以修改内核数据结构或使用内核特权执行任意代码。以前保护商用操作系统内核不受设备驱动程序影响的技术要么性能低下，要么仅限于特定类别的漏洞，比如内存错误。受用户模式驱动程序框架的启发，该项目采用三管齐下的方法来保护内核数据免受设备驱动程序漏洞的影响。首先，这个项目将开发技术来监视由设备驱动程序发起的内核数据结构更新，并确保它们不会损害这些数据结构的完整性。其次，它将开发一些技术来限制驱动程序通过DMA访问内核内存，而不需要硬件支持，但如果有的话可以利用它。第三，它将开发新技术，从受损的驱动程序中恢复。这些技术适用于独立商用操作系统上的遗留设备驱动程序，并且需要对操作系统进行最小的更改。此外，它们对设备驱动程序的普通情况性能施加的开销可以忽略不计，因此即使在高吞吐量设备上使用也是实用的。

Device drivers constitute a large fraction of the code in commodity operating systems. Over 35,000 drivers with over 112,000 versions exist for Windows XP, while over 3.1 million lines out of 5.4 million lines of the Linux kernel is device driver code. As several recent exploits against device drivers show, drivers are rife with bugs that compromise system security.Exploits against device drivers are dangerous because commodity operating systems execute drivers in kernel address space. A compromised driver can modify kernel data structures or execute arbitrary code with kernel privilege. Prior techniques that protect commodity OS kernels from device drivers either suffer from low performance or are limited to specific classes of vulnerabilities, such as memory errors.Inspired by user-mode driver frameworks, this project applies a three-pronged approach to the problem of protecting kernel data from vulnerabilities in device drivers. First, this project will develop techniques to monitor kernel data structure updates initiated by device drivers and ensure that they do not compromise the integrity of these data structures. Second, it will develop techniques to limit driver access to kernel memory via DMA without requiring hardware support yet taking advantage of it if available. Third, it will develop new techniques for recovering from compromised drivers.These techniques are applicable to legacy device drivers on standalone commodity operating systems and require minimal changes to the operating system. In addition, they impose negligible overheads on common-case performance of device drivers and are thus practical for use even with high-throughput devices.