Speculative Probing

The drivers of modern operating systems use Direct Memory Access (DMA) to efficiently communicate with peripheral devices. Since the memory accessed by DMA is a shared resource between driver and device, it is a possible source of race conditions. Peripheral devices are also often untrusted, so these race conditions open up a new potential attack vector against a trusted OS kernel. In this paper, we present DMARacer, a dynamic detector called for these DMA-based race conditions in kernel code. DMARacer tracks memory accesses to DMA memory throughout the kernel's lifetime and analyses them for various indicators of race conditions. Additionally, upon detecting a race condition, DMARacer uses taint tracking to trace its impact and identify any potential vulnerabilities it may trigger, such as memory corruption or denial-of-service. We used DMARacer to search the drivers of the Linux kernel for DMA-based errors and find that DMA-based race conditions are a systemic issue in driver code. In total, DMARacer was able to detect 817 problematic memory accesses and 344 vulnerable operations in the scanned Linux kernel drivers.

Data-flow bending: On the effectiveness of data-flow integrity

The large scale application of reuse to support software development is not a new concept. Over twenty years ago, M. D. McIlroy expressed the need for: “… standard catalogues of routines, classified by precision, robustness, time-space performance, size limits, and binding time of parameters.” [McIlroy 68] He also provided insight that is still valid into: “… the kinds of variability necessary in software components, ways of producing useful inventories, types of components that are ripe for such standardization, and methods of instituting pilot production.”McIlroy emphasized the importance of abstraction of common principles in developing these routines, the need for automatic generators, and uniformity of engineering. He also enumerated the degree of parameterization needed for successful reusable software: Choice of precisionChoice of robustness, trading off reliability and time-space performanceChoice of time-space behaviorChoice of algorithmChoice of interfaces with standards for types of error conditionsChoice of storage accessing methodChoice of data structures within a given algorithm or within different related algorithmsIn the utility and tool area, these concerns have been met with stable, understandable and supported reusable software subsystems to support applications development. Examples of this software are collections of abstract data structures, data base management systems, development environments, and network managers. Requirements for new applications that depend on reuse of such general subsystems software are specified in light of the existence of that software. The development can achieve significant productivity gains when the software subsystems are reused.Except in reusing these subsystems, reusable software practice has not had the same level of success in specific application areas, with few exceptions. For domains such as command and control, communications, avionics, and shipboard systems, reusable software must address specific application requirements particular to the given domain. The development of a reusable air traffic control architecture by Thomson-CSF is an example of reuse that addresses the requirements of a specific application. [Andribet 90] The details of the architectures and components developed by Thomson-CSF remain within the company, and may have limited applicability for other organizations that develop similar systems but use alternate design strategies. The Common Ada Missile Packages (CAMP) project has also produced reusable software components, primarily for missile operational software, but this software has seen only limited application. [McNicholl 88]

A software practice like code reusability in the successive upgradations of the particular software is increasing vigorously. The software is upgraded when the new requirements of the customers explored in the market, thus it includes some of its own newly defined functionalities and some existing functionalities. However, the upgradation/version also includes the vulnerabilities which are generated either due to the effect of new features or the shared ones that were not resolved while testing. In operational phase, the vulnerabilities are discovered through the users who may adopt multiple versions of the software or have used only the single version. We have observed that the developers face many problems while predicting the multi upgradation vulnerabilities as some proportion of the vulnerabilities and the users of the successive versions are found to be similar. In this research work, we proposed a mathematical model that highlights the prediction of user-dependent vulnerabilities in a Multi-Upgradation software system. The model emphasizes on the impact of the shared code on the vulnerability's frequency rate and user's growth rate. A numerical is illustrated to validate the model capabilities with the help of real life data set.

Many emerging applications from various domains often exhibit heterogeneous memory characteristics. When running in combination on parallel platforms, these applications present a daunting variety of workload behaviors that challenge the effectiveness of any memory allocation strategy. Prior partitioning-based or random memory allocation schemes typically manage only one level of the memory hierarchy and often target specific workloads. To handle diverse and dynamically changing memory and cache allocation needs, we augment existing "horizontal" cache/DRAM bank partitioning with vertical partitioning and explore the resulting multi-policy space. We study the performance of these policies for over 2000 workloads and correlate the results with application characteristics via a data mining approach. Based on this correlation we derive several practical memory allocation rules that we integrate into a unified multi-policy framework to guide resources partitioning and coalescing for dynamic and diverse multiprogrammed/ threaded workloads. We implement our approach in Linux kernel 2.6.32 as a restructured page indexing system plus a series of kernel modules. Extensive experiments show that, in practice, our framework can select proper memory allocation policy and consistently outperforms the unmodified Linux kernel, achieving up to 11% performance gains compared to prior techniques

Many emerging applications from various domains often exhibit heterogeneous memory characteristics. When running in combination on parallel platforms, these applications present a daunting variety of workload behaviors that challenge the effectiveness of any memory allocation strategy. Prior partitioning-based or random memory allocation schemes typically manage only one level of the memory hierarchy and often target specific workloads. To handle diverse and dynamically changing memory and cache allocation needs, we augment existing “horizontal” cache/DRAM bank partitioning with vertical partitioning and explore the resulting multi-policy space. We study the performance of these policies for over 2000 workloads and correlate the results with application characteristics via a data mining approach. Based on this correlation we derive several practical memory allocation rules that we integrate into a unified multi-policy framework to guide resources partitioning and coalescing for dynamic and diverse multi-programmed/threaded workloads. We implement our approach in Linux kernel 2.6.32 as a restructured page indexing system plus a series of kernel modules. Extensive experiments show that, in practice, our framework can select proper memory allocation policy and consistently outperforms the unmodified Linux kernel, achieving up to 11% performance gains compared to prior techniques.

Persistent Memory (PM) is a new device which provides faster access than conventional storage devices, such as SSDs. Among several methods prepared for accessing files on PM, a combination of filesystem direct access (DAX) and mmap() is used to take advantage of its native abilities. We can avoid buffer cache and access PM with byte granularity. To make sure that stored data is persisted, we need to synchronize the data on the CPU cache to PM. One option is an msync() system call and another is pmem_persist(). DAX enabled filesystems implement msync(), as it can synchronize data with CPU instructions, such as CLWB or CLFLUSHOPT. An alternative is pmem_persist(), which is included in the Persistent Memory Development Kit and issues those CPU instructions directly from the user space. msync() has the advantage of not having to modify legacy applications, while pmem_persist() is faster since it does not incur context switches. There are legacy applications which use mmap() and msync() to gain high performance, even though their original targets are traditional storage devices. They should be able to take advantage of PM's ability without any code modifications. Kyoto Cabinet, a library of routines for managing a database, is an example [1]. This paper reports on a case in which msync() resulted in tremendously slow performance on a DAX enabled ext4 filesystem. Throughput of a 4KiB random store followed by a 4KiB msync() was 1.1k IOPS, while 192k IOPS can be obtained with pmem_persist(). File size was 100MiB for both cases and the whole region was mapped. Moreover, a SET operation for Kyoto Cabinet database with OAUTOSYNC enabled takes 4.87ms when stored on a PM, while 0.77ms is taken when stored on an SSD. The time used for msync() is 3.00ms and 0.33ms respectively. PM was Intel Optane DC Persistent Memory and Linux kernel was 5.4.0. This performance loss comes from the side effect of the 2MiB hugepage.mmap() tries to allocate 2MiB pages instead of 4KiB pages when a region greater than 2MiB is requested. Since a dirty flag is associated to a whole 2MiB page, a kernel has to flush all of the 2MiB at once, even though msync() only requests a 4KiB flush. Though hugepage support has several advantages, such as fewer page faults and smaller page tables, this performance problem hinders legacy applications to use PM without any code modifications. The result below shows how this hugepage side effect is large. It is obtained with a kernel in which CONFIG_FS_DAX_PMD is disabled. Throughput of a 4KiB random store followed by a 4KiB msync() increases to 174k IOPS. In addition, the latency of a Kyoto Cabinet SET operation decreases to 0.30ms and the time spent for msync() decreases to 0.03ms. Though disabling hugepage results in better performance, it cannot be the best solution, as hugepage offers several advantages. So, I will conclude the abstract by mentioning a method which would avoid a performance loss, even with hugepages. Since the root cause is that a dirty flag manages the 2MiB page as a whole, preparing 512 dirty flags every 4KiB would work. It will reduce the size of wasted cache line flush to nearly zero when msync() requests the flushing of a small region. In addition, some optimizations may be required for a large flush request, since flushing 512 4KiB pages would take longer compared to flushing a 2MiB page.

Adversaries exploit memory corruption vulnerabilities to hijack a program's control flow and gain arbitrary code execution. One promising mitigation, control-flow integrity (CFI), has been the subject of extensive research in the past decade. One of the core findings is that adversaries can construct Turing-complete code-reuse attacks against coarse-grained CFI policies because they admit control flows that are not part of the original program. This insight led the research community to focus on fine-grained CFI implementations. In this paper we show how to exploit heap-based vulnerabilities to control the stack contents including security-critical values used to validate control-flow transfers. Our investigation shows that although program analysis and compiler-based mitigations reduce stack-based vulnerabilities, stack-based memory corruption remains an open problem. Using the Chromium web browser we demonstrate real-world attacks against various CFI implementations: 1)~against CFI implementations under Windows 32-bit by exploiting unprotected context switches, and 2)~against state-of-the-art fine-grained CFI implementations (IFCC and VTV) in the two premier open-source compilers under Unix-like operating systems. Both 32 and 64-bit x86 CFI checks are vulnerable to stack manipulation. Finally, we provide an exploit technique against the latest shadow stack implementation.

Matter-light quantum interface and quantum memory for light are important ingredients of quantum information protocols, such as quantum networks, distributed quantum computation, etc. [P. Zoller et al., Eur. Phys. J. D 36, 203 (2005)]. In this paper we present a spatially multimode scheme for quantum memory for light, which we call a quantum hologram. Our approach uses a multiatom ensemble which has been shown to be efficient for a single spatial mode quantum memory. Due to the multiatom nature of the ensemble and to the optical parallelism it is capable of storing many spatial modes, a feature critical for the present proposal. A quantum hologram with the fidelity exceeding that of classical hologram will be able to store quantum features of an image, such as multimode superposition and entangled quantum states, something that a standard hologram is unable to achieve.

Component-based software development method is one of the research hotspots in the field of software reuse at present. The main purpose of kernel clipping is to make the system meet the application needs and adapt to the system hardware platform to the maximum extent, and realize the information interaction between PLC communication and network communication, so that the browsing commands from the client can browse the information of the industrial site, and the control commands can be executed by the PC. The structure and main contents of software design include compiling Boot Loader program to start and load Linux kernel, compiling Linux kernel and its supporting root file system, etc. In this paper, the hardware and software solutions of embedded system based on ARM processor are designed and implemented. Linux is transplanted to LH79520, and the network communication acceleration function of embedded system is realized.

Code diversification has been proposed as a technique to mitigate code reuse attacks, which have recently become the predominant way for attackers to exploit memory corruption vulnerabilities. As code reuse attacks require detailed knowledge of where code is in memory, diversification techniques attempt to mitigate these attacks by randomizing what instructions are executed and where code is located in memory. As an attacker cannot read the diversified code, it is assumed he cannot reliably exploit the code. In this paper, we show that the fundamental assumption behind code diversity can be broken, as executing the code reveals information about the code. Thus, we can leak information without needing to read the code. We demonstrate how an attacker can utilize a memory corruption vulnerability to create side channels that leak information in novel ways, removing the need for a memory disclosure vulnerability. We introduce seven new classes of attacks that involve fault analysis and timing side channels, where each allows a remote attacker to learn how code has been diversified.

Due to the impracticability of generating true randomness by running deterministic algorithms in computers, boot-loaders and operating systems undergo the lack of enough supplies of entropy at boot-time. This problem remains a challenge and affects all computer systems, including virtualization technologies. Unfortunately, this situation leads to undesired side effects, affecting the security of important kernel components and causing large blocking waits in the start-up of userland processes. For example, SSHD is delayed up to 4 minutes. In this paper, we analyze the boot-time entropy starvation problem, performing a comprehensive analysis of the Linux kernel boot process revealing that the problem not only affects userland applications but up to 33 kernel functions at boot time. Those functions are weakly fed by random numbers from a non-initialized CSPRNG. To overcome this problem, we propose E-Boot, a novel technique that provides high-quality random numbers to guest virtual machines. E-Boot is the first technique that completely satisfies the entropy demand of virtualized boot-loaders and operating systems at boot time. We have implemented E-Boot in Linux v5.3 and our experiments show that it effectively solves the boot-time entropy starvation problem. Our proposal successfully feeds bootloaders and boot time Linux kernel hardening techniques with high-quality random numbers, reducing also to zero the number of userspace blocks and delays. The total time overhead introduced by E-Boot is around 2 μs and has zero memory overhead, since the memory is freed before the kernel boot ends, which makes E-boot a practical solution for cloud systems.

Memory corruption vulnerabilities in type-unsafe languages are often exploited to perform a control-flow hijacking attack, in which an attacker uses vulnerabilities to corrupt control data in the program to eventually gain control over the execution of the program. However, widespread adoption of control-flow attack defenses such as Control-flow Integrity(CFI) has led attackers to exploit memory errors to corrupt non-control data that can not be detected by these defenses. Non-control data attacks can be used to corrupt security critical data or leak sensitive information. Moreover, recent attacks such as data-oriented programming (DOP) have generalized non-control data attacks to achieve Turing-complete computation capabilities within the programmer-specified control-flow graph, leaving previously proposed control-flow protections unable to stop these attacks. In this paper, we present a stack-layout randomization scheme that can effectively thwart DOP attacks. Our approach, called Smokestack, provides each function invocation with a randomly permuted ordering of the local stack organization. In addition, we utilize true-random value sources combined with disclosure-resistant pseudo-random number generation to ensure that an adversary cannot anticipate a function’s invocation permutation of automatic variables. Our evaluation on SPEC benchmarks and various real-world applications shows that Smokestack can stop DOP attacks with minimal overhead.

Recent results of a nationwide study of a new combination of drugs to treat pancreatic cancer show that the rare but deadly disease still has the upper hand.The study was conducted by a national consortium of cancer researchers called the Cancer and Leukemia Group B (CALGB). The CALGB Gastrointestinal Cancer Committee, which designed the study, is headed by Dr. Richard M. Goldberg, professor of medicine, chief of hematology-oncology, and associate director for clinical research at the UNC Lineberger Comprehensive Cancer Center.The study, funded by the National Cancer Institute, was presented January 21 at the American Society of Clinical Oncology’s Gastrointestinal Cancer Symposium in Orlando, Florida. The nine co-authors were from Memorial Sloan-Kettering Cancer Center, Duke University Medical Center, the University of Chicago and Northwestern University Medical Center. Principal investigator is Dr. HedyKindler, associate professor of medicine at the University of Chicago.About 30,000 new cases of pancreatic cancer are diagnosed each year and the overwhelming majority of those new cases will survive only a few months. The disease usually is diagnosed late and, in most cases, doesn’t respond to chemotherapy. While great strides have been made in diagnosing and treating most cancers, “pancreatic cancer is particularly resistant to current therapies,” said Goldberg, “but a recent report offered a glimmer of hope.”That small trial from the University of Chicago used gemcitabine (a chemotherapeutic agent) plus bevacizumab (trade name Avastin®) to treat pancreatic cancer patients. Promising results showed an increase in survival time from the typical 4-6 months to nearly 9 months. Avastin®, an angiogenesis inhibitor, has been shown to be successful in treating colon, lung and other cancers. Angiogenesis inhibitors limit the growth of new blood vessels and make those blood vessels more easy for drugs to pass through allowing chemotherapy to penetrate tumors more effectively.The hopeful results of the earlier trial led the CALGB to conduct a larger national trial. In just under 2 years, over 600 patients were enrolled making this “one of the largest trials on pancreatic cancer ever undertaken,” according to Goldberg. “Getting this number of patients enrolled in such a short time shows the intense interest in finding better treatment options for patients with cancer of the pancreas,” he said.The patients were men and women, most in their middle 60’s, whose disease had already spread beyond the pancreas. Half the patients continued standard therapy (gemcitabine plus a placebo) while the other half took the combination of drugs used in the Chicago trial.Near the conclusion of the project, it became apparent that the new treatment regimen was no better than gemcitabine alone as no difference was observed in survival rates between the 2 groups. At that time, the randomization scheme was revealed, allowing the remaining patients to be treated according to their physician’s discretion.“The primary question was whether an angiogenesis inhibitor combined with a chemotherapeutic agent would improve survival in patients with pancreatic cancer. The answer was clearly no,” Goldberg said.Other aspects of the project included studies still underway to help unravel the molecular biology of the disease, assess the quality of life of enrolled patients, and economic issues.“The potential for side effects and tumor shrinkage are influenced by the patient’s unique genetics that will ultimately affect prognosis. Tumor shrinkage will also affect quality of life and economic aspects of the disease,” Goldberg explained. “Regrettably, this combination of drugs that first appeared to be so hopeful, failed to affect this tumor like it does other tumors.” Noting that treatment effectiveness found in small trials is not always confirmed in larger studies of patients, Goldberg said this larger trial had a more diverse patient population than the Chicago study. “The patient mix was more consistent with the typical patient mix across the country and thisprobably was a factor in our results differing from those seen in the group of patients from Chicago.” Still, the UNC researcher said that results from a negative study give valuable insights into the nature of pancreatic cancer, thus improving our understanding for improved patient care and quality of life. “Results like these demonstrate that research needs to be disease-specific. Investigations will continue to attack this disease,” Goldberg said.The CALGB co-authors included Drs. Hedy Kindler and Richard Schilsky from the University of Chicago, Dr. Deborah Schrag from Memorial Sloan Kettering Cancer Center, Dr. Mary Mulcahy from Northwestern University Medical Center, Dr. Herbert Hurwitz from Duke University Medical Center, Dr. Howard McLeod from the University of North Carolina at Chapel Hill, and CALGB statisticians Drs. Donna Niedzwiecki, Donna Hollis, and Ebele Oraefo from Duke University Medical Center.For more information, please contact: Leslie Lang; Tel.: 919.843.9687 or Dianne Shaw; 919.966.7834.

A class of program transformations and data-flow-analysis tools is reviewed. The authors focus on supporting code reuse and maintenance by exploring transformations which modify programs. Typical purposes of modifications are to simplify programs, make side effects more visible, improve locality, or detect useless code. The authors review several methods which have been described for program simplification and identifying side effects. The authors describe an additional approach based on extracting information from parse tree representations of programs. The information is represented using various matrices; useless computations and side effects are identified through matrices.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>