More Like this

1. SCAVY: Automated Discovery of Memory Corruption Targets in Linux Kernel for Privilege Escalation

   Avllazagaj, Erin ; Kwon, Yonghwi ; Dumitraș, Tudor ( August 2024 , USENIX Association)

   Balzarotti, Davide ; Xu, Wenyuan (Ed.)

   Kernel privilege-escalation exploits typically leverage memory-corruption vulnerabilities to overwrite particular target locations. These memory corruption targets play a critical role in the exploits, as they determine which privileged resources (e.g., files, memory, and operations) the adversary may access and what privileges (e.g., read, write, and unrestricted) they may gain. While prior research has made important advances in discovering vulnerabilities and achieving privilege escalation, in practice, the exploits rely on the few memory corruption targets that have been discovered manually so far. We propose SCAVY, a framework that automatically discovers memory corruption targets for privilege escalation in the Linux kernel. SCAVY's key insight lies in broadening the search scope beyond the kernel data structures explored in prior work, which focused on function pointers or pointers to structures that include them, to encompass the remaining 90% of Linux kernel structures. Additionally, the search is bug-type agnostic, as it considers any memory corruption capability. To this end, we develop novel and scalable techniques that combine fuzzing and differential analysis to automatically explore and detect privilege escalation by comparing the accessibility of resources between executions with and without corruption. This allows SCAVY to determine that corrupting a certain field puts the system in an exploitable state, independently of the vulnerability exploited. SCAVY found 955 PoC, from which we identify 17 new fields in 12 structures that can enable privilege escalation. We utilize these targets to develop 6 exploits for 5 CVE vulnerabilities. Our findings show that new memory corruption targets can change the security implications of vulnerabilities, urging researchers to proactively discover memory corruption targets. 

   more » « less
2. Climate change and Utah ski resorts: impacts, perceptions, and adaptation strategies

   Wilkins, E. ; Akbar, H. ; Saley, T. ; Hager, R. ; Elkin, C. ; Belmont, P. ; Flint, C. ; Smith, J. ( January 2021 , Mountain research and development)

   Climate change is a threat to ski resorts, the ski industry, and mountain communities that rely on ski tourism. Ski resorts may be able to mitigate some of the social and economic impacts caused by climate change with proactive adaptation strategies. Using historical weather data, future climate projections, and interviews with ski resort managers in Utah (United States), this research investigates the effects of climate change on ski resorts across the state. We examine temperature change at all resorts within the state from 1980– 2018 and climate projections from 2021–2100 under different climate change scenarios (RCPs 2.6, 4.5, and 8.5). We also report on semistructured interviews with resort managers to provide insights into how resort leadership perceives the impacts of climate change, is implementing adaptation strategies, and is addressing barriers to adaptation. Many resorts in Utah are warming faster than global averages, and minimum temperatures are rising faster than maximum temperatures. By the end of the century, winter (December–March) minimum daily temperatures in Utah could warm an additional 6.08C under the RCP 8.5 scenario near northern Utah resorts and 6.68C near southern Utah resorts. Resort managers are concerned about shorter season lengths, shifting ski seasons, less snow cover, and poorer snow quality. Many resorts are already adapting, with the most common adaptations being snowmaking and diversifying outdoor recreation offerings (particularly during the summer and shoulder seasons). Barriers to adaptation reported by managers include financial costs, adequate water availability for snowmaking, and uncertainty about climate change projections. Climate change is already impacting Utah ski resorts, but adaptation practices can reduce the negative impacts to some degree at most resorts. 

   more » « less
3. Accelerating Packet Processing in Container Overlay Networks via Packet-level Parallelism

   https://doi.org/10.1109/IPDPS54959.2023.00018  

   Lei, Jiaxin ; Munikar, Manish ; Lu, Hui ; Jia, Rao ( May 2023 , Proceedings IEEE International Parallel and Distributed Processing Symposium)

   Overlay networks serve as the de facto network virtualization technique for providing connectivity among distributed containers. Despite the flexibility in building customized private container networks, overlay networks incur significant performance loss compared to physical networks (i.e., the native). The culprit lies in the inclusion of multiple network processing stages in overlay networks, which prolongs the network processing path and overloads CPU cores. In this paper, we propose mFlow, a novel packet steering approach to parallelize the in-kernel data path of network flows. mFlow exploits packet-level parallelism in the kernel network stack by splitting the packets of the same flow into multiple micro-flows, which can be processed in parallel on multiple cores. mFlow devises new, generic mechanisms for flow splitting while preserving in-order packet delivery with little overhead. Our evaluation with both micro-benchmarks and real-world applications demonstrates the effectiveness of mFlow, with significantly improved performance – e.g., by 81% in TCP throughput and 139% in UDP compared to vanilla overlay networks. mFlow even achieved higher TCP throughput than the native (e.g., 29.8 vs. 26.6 Gbps). 

   more » « less
4. Spectrally Transformed Kernel Regression

   Zhai, Runtian ; Pukdee, Rattana ; Jin, Roger ; Balcan, Maria-Florina ; Ravikumar, Pradeep ( May 2024 , International Conference on Learning Representations (ICLR), 2024)

   Unlabeled data is a key component of modern machine learning. In general, the role of unlabeled data is to impose a form of smoothness, usually from the similarity information encoded in a base kernel, such as the ε-neighbor kernel or the adjacency matrix of a graph. This work revisits the classical idea of spectrally transformed kernel regression (STKR), and provides a new class of general and scalable STKR estimators able to leverage unlabeled data. Intuitively, via spectral transformation, STKR exploits the data distribution for which unlabeled data can provide additional information. First, we show that STKR is a principled and general approach, by characterizing a universal type of “target smoothness”, and proving that any sufficiently smooth function can be learned by STKR. Second, we provide scalable STKR implementations for the inductive setting and a general transformation function, while prior work is mostly limited to the transductive setting. Third, we derive statistical guarantees for two scenarios: STKR with a known polynomial transformation, and STKR with kernel PCA when the transformation is unknown. Overall, we believe that this work helps deepen our understanding of how to work with unlabeled data, and its generality makes it easier to inspire new methods. 

   more » « less
5. LXDs: Towards Isolation of Kernel Subsystems

   Narayanan, Vikram ; Balasubramanian, Abhiram ; Jacobsen, Charlie ; Spall, Sarah ; Bauer, Scott ; Quigley, Michael ; Hussain, Aftab ; Younis, Abdullah ; Shen, Junjie ; Bhattacharyya, Moinak ; et al ( January 2019 , Proceedings of the USENIX Conference)

   Modern operating systems are monolithic. Today, however, lack of isolation is one of the main factors undermining security of the kernel. Inherent complexity of the kernel code and rapid development pace combined with the use of unsafe, low-level programming language results in a steady stream of errors. Even after decades of efforts to make commodity kernels more secure, i.e., development of numerous static and dynamic approaches aimed to prevent exploitation of most common errors, several hundreds of serious kernel vulnerabilities are reported every year. Unfortunately, in a monolithic kernel a single exploitable vulnerability potentially provides an attacker with access to the entire kernel.Modern kernels need isolation as a practical means of confining the effects of exploits to individual kernel subsystems. Historically, introducing isolation in the kernel is hard. First, commodity hardware interfaces provide no support for efficient, fine-grained isolation. Second, the complexity of a modern kernel prevents a naive decomposition effort. Our work on Lightweight Execution Domains (LXDs) takes a step towards enabling isolation in a full-featured operating system kernel. LXDs allow one to take an existing kernel subsystem and run it inside an isolated domain with minimal or no modifications and with a minimal overhead. We evaluate our approach by developing isolated versions of several performance-critical device drivers in the Linux kernel. 

   more » « less