Hardening hypervisors against vulnerabilities in instruction emulators

Kenta Ishiguro, Kenji Kono

Research output: Chapter in Book/Report/Conference proceedingConference contribution

6 Citations (Scopus)

Abstract

Vulnerabilities in hypervisors are crucial in multi-tenant clouds and attractive for attackers because a vulnerability in the hypervisor can undermine all the virtual machine (VM) security. This paper focuses on vulnerabilities in instruction emulators inside hypervisors. Vulnerabilities in instruction emulators are not rare; CVE-2017-2583, CVE-2016-9756, CVE-2015-0239, CVE-2014-3647, to name a few. For backward compatibility with legacy x86 CPUs, conventional hypervisors emulate arbitrary instructions at any time if requested. This design leads to a large attack surface, making it hard to get rid of vulnerabilities in the emulator. This paper proposes FWinst that narrows the attack surface against vulnerabilities in the emulator. The key insight behind FWinst is that the emulator should emulate only a small subset of instructions, depending on the underlying CPU micro-architecture and the hypervisor configuration. FWinst recognizes emulation contexts in which the instruction emulator is invoked, and identifies a legitimate subset of instructions that are allowed to be emulated in the current context. By filtering out illegitimate instructions, FWinst narrows the attack surface. In particular, FWinst is effective on recent x86 micro-architectures because the legitimate subset becomes very small. Our experimental results demonstrate FWinst prevents existing vulnerabilities in the emulator from being exploited on Westmere micro-architecture, and the runtime overhead is negligible.

Original languageEnglish
Title of host publicationProceedings of the 11th European Workshop on Systems Security, EuroSec 2018
PublisherAssociation for Computing Machinery, Inc
ISBN (Electronic)9781450356527
DOIs
Publication statusPublished - 2018 Apr 23
Event11th European Workshop on Systems Security, EuroSec 2018 - Porto, Portugal
Duration: 2018 Apr 23 → …

Publication series

NameProceedings of the 11th European Workshop on Systems Security, EuroSec 2018

Other

Other11th European Workshop on Systems Security, EuroSec 2018
Country/TerritoryPortugal
CityPorto
Period18/4/23 → …

Keywords

  • Hypervisor
  • Instruction emulator
  • Security
  • Virtualization

ASJC Scopus subject areas

  • Hardware and Architecture
  • Computer Networks and Communications
  • Safety, Risk, Reliability and Quality

Fingerprint

Dive into the research topics of 'Hardening hypervisors against vulnerabilities in instruction emulators'. Together they form a unique fingerprint.

Cite this