Description
As cloud environments gain popularity, technologies and features to protect the security
of Virtual Machines (VMs) from malicious cloud providers are needed as well. To
achieve this, AMD introduced Secure Encrypted Virtualization (SEV) and its extensions
SEV Encrypted State (SEV-ES) and SEV Secure Nested Paging (SEV-SNP), that enable a
VM to encrypt its memory, register state and ensure its memory integrity.
Independent of virtualization, to protect from attacks that exploit knowledge about
xed kernel symbol addresses, the Linux kernel employs the security feature Kernel
Address Space Layout Randomization (KASLR). KASLR randomizes the physical
location that the kernel will be loaded to on every boot. However, it was shown that
malicious outsiders are capable of circumventing KASLR, and even SEV(-ES) cannot
prevent adversaries from breaking an encrypted VM’s KASLR.
Function Granular KASLR (FGKASLR) is a newer extension to the KASLR mechanism
aimed to further enhance the Linux kernel’s security by randomizing additional kernel
properties on boot.
In this thesis, we evaluate three such attacks that are capable of deducing the physical
KASLR offset of a SEV-ES protected VM with FGKASLR. By manipulating the VM’s
early entropy, tracking the VM’s memory accesses and injecting interrupts into the VM,
we analyze and assess the security of FGKASLR in an encrypted VM.
We will show that a SEV-ES protected VM with FGKASLR can successfully prevent
the majority of kernel function addresses from being discovered by a malicious attacker.
However, a VM without SEV-ES protection can successfully be manipulated by limiting
its entropy.
|
Thesis topic in co-operation with the Fraunhofer Institute for Applied and Integrated Security AISEC, Garching