[SPARTA - bodies.dissemination-committee] Submitted Paper

Dear all, Sorry for the delayed notification. We have submitted a paper with the following title and abstract: Title: "xMP: Selective Memory Protection for Kernel and User Space" Abstract: Attackers leverage memory corruption vulnerabilities to establish primitives for reading from or writing to the address space of the vulnerable process. These primitives form the foundation for code-reuse and data-oriented attacks. While various defenses against the former class of attacks have proven effective, mitigation of the latter remains an open problem. In this paper, we identify various shortcomings of the x86 architecture regarding memory isolation, and leverage virtualization to build an effective defense against data-oriented attacks. We implement xMP, which consists of (in-guest) selective memory protection primitives that equip VMs with the ability to isolate sensitive data in user or kernel space into disjoint protection domains. We interface the Xen altp2m subsystem with the Linux memory management system, lending VMs the flexibility to define custom policies. Contrary to conventional approaches, xMP takes advantage of virtualization extensions, but after initialization, it does not require any hypervisor intervention. To ensure the integrity of in-kernel management information, and pointers to sensitive data within protection domains, xMP protects pointers with HMACs bound to an immutable context, so that integrity validation succeeds only in the right context. We have applied xMP to fortify the page tables and process credentials of the Linux kernel, as well as sensitive data in various user-space applications. Overall, our evaluation shows that xMP introduces minimal overhead for real-world workloads and applications, and offers effective protection against data-oriented attacks. Once this paper gets accepted, we will acknowledge SPARTA. Best, ~Sergej -- Sergej Proskurin, M.Sc. Wissenschaftlicher Mitarbeiter Technische Universität München Fakultät für Informatik Lehrstuhl für Sicherheit in der Informatik Boltzmannstraße 3 85748 Garching (bei München) Tel. +49 (0)89 289-18592 Fax +49 (0)89 289-18579