一句话：提出 FortifyPatch，利用 Arm CCA 与 TrustZone/PMU 实现抗篡改的 Linux hypervisor 热补丁，并支持全局变量补丁。
Linux 云服务器中基于 Linux 的 hypervisor 面临内核漏洞，现有热补丁方案无法防止部署后的补丁被篡改，且难以处理涉及全局变量的补丁。FortifyPatch 利用 Arm CCA 的多个 Granule Protection Tables 保护已部署补丁完整性，并用 TrustZone Address Space Controller 防止绕过补丁、用 Performance Monitor Unit 及时验证页表；还通过精心设计的数据访问陷阱支持全局变量补丁。原型在真实 CVE 补丁上评估，可部署 81.5% 的 CVE 补丁；在代表性基准和真实应用上平均开销分别为 0.98% 和 3.1%。
Linux-based hypervisors in the cloud server suffer from an increasing number of vulnerabilities in the Linux kernel.To address these vulnerabilities in a timely manner while avoiding the economic loss caused by unplanned shutdowns, live patching schemes have been developed. Unfortunately, existing live patching solutions have failed to protect patches from post-deployment attacks. In addition, patches that involve changes to global variables can lead to practical issues with existing solutions. To address these problems, we present FortifyPatch, a tamper-resistant live patching solution for Linux-based hypervisors in cloud environments. Specifically, FortifyPatch employs multiple Granule Protection Tables from Arm Confidential Computing Architecture to protect the integrity of deployed patches. TrustZone Address Space Controller and Performance Monitor Unit are used to prevent the bypassing of the Patch via kernel code protection and timely page table verification. FortifyPatch is also able to patch global variables via well-designed data access traps.We prototype FortifyPatch and evaluate it using real-world CVE patches. The result shows that FortifyPatch is capable of deploying 81.5% of CVE patches. The performance evaluation indicates that FortifyPatch protects deployed patches with 0.98% and 3.1% overhead on average across indicative benchmarks and real-world applications, respectively.
DOI 原文 ·
@inproceedings{paperbot8559,
title = {FortifyPatch: Towards Tamper-Resistant Live Patching in Linux-Based Hypervisor},
author = {Zhenyu Ye and Lei Zhou and Fengwei Zhang and Wenqiang Jin and Zhenyu Ning and Yupeng Hu and Zheng Qin},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3652108}
}