Secure and Efficient Multi-Variant Execution Using Hardware-Assisted Process Virtualization

Abstract

Memory error exploits rank among the most serious security threats. Of the plethora of memory error containment solutions proposed over the years, most have proven to be too weak in practice. Multi-Variant eXecution (MVX) solutions can potentially detect arbitrary memory error exploits via divergent behavior observed in diversified program variants running in parallel. However, none have found practical applicability in security due to their non-trivial performance limitations. In this paper, we present MvArmor, an MVX system that uses hardware-assisted process virtualization to monitor variants for divergent behavior in an efficient yet secure way. To provide comprehensive protection against memory error exploits, MvArmor relies on a new MVX-aware variant generation strategy. The system supports user-configurable security policies to tune the performance-security trade-off. Our analysis shows that MvArmor can counter many classes of modern attacks at the cost of modest performance overhead, even with conservative detection policies.

Proceedings of the 15th ACM International Conference on Computing Frontiers

“…The architecture of FreeDA, shown in Figure 1, is similar to stateof-the-art second-generation MVE systems [28,29,44]. FreeDA executes several versions in the same MVE deployment, each in its own process: a fast native version, with which the users interact directly; and a DA version for each dynamic analysis.…”

“…FreeDA leverages Multi-Version Execution (MVE) [17,19,20,23,27,29,31,37,44,46,47] to run the native application concurrently with several DA versions (e.g., in parallel with Valgrind and compilersanitized versions), each in their own process. FreeDA leverages the record-replay strategy used in the second-generation of multiversion execution systems [28,29,44,46], by recording the results of system calls issued by the native version into an in-memory system-call buffer, while each DA version reads the results of its system calls from this buffer. This separation allows FreeDA to run the native version at full speed (minus the small time needed to write the results of system calls into a buffer), while each DA version operates at a lower speed in the background.…”

Taming Parallelism in a Multi-Variant Execution Environment

“…As Table 2 shows, dedup executes over 134K system calls 1.02M sync ops per second, whereas barnes and radiosity execute more than 19K and 33K system calls per second and 5.12M and 18.25M sync ops per second resp. Each of the system calls invokes the MVEE monitor, which constitutes a performance bottleneck even in the most efficient security-oriented MVEEs [21,45].…”

“…Multi-Variant Execution Environments (MVEEs) have become a hot research topic due to their potential to break the seemingly endless cycle of new mitigations being bypassed by new exploits which are then addressed by yet more mitigations [13,19,21,30,37,44,45]. The fundamental idea is to execute two or more functionally equivalent programs (variants) in lockstep and monitor their behavior at the level of system calls.…”

“…In both cases, the monitor executed in a different context than the variants [12,13,18,30,37,43]. More recent work has explored decentralized monitors that run in the same execution context as the variants to some degree [19,21,45]. In the decentralized designs, the monitor can intercept system calls directly, whereas the external monitor designs require context switching to invoke the monitor.…”