PANIC: PAN-assisted Intra-process Memory Isolation on ARM

Jiali Xu1; Mengyao Xie1; Chenggang Wu1; Yinqian Zhang2; Qijing Li3; Xuan Huang4; Yuanming Lai1; Yan Kang1; Yan Kang1; Qiang Wei5; Zhe Wang1

10.1145/3576915.3623206

2023

30th ACM SIGSAC Conference on Computer and Communications Security (ACM CCS)

PROCEEDINGS OF THE 2023 ACM SIGSAC CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY, CCS 2023

NOV 26-30, 2023

null,Copenhagen,DENMARK

1601 Broadway, 10th Floor, NEW YORK, NY, UNITED STATES

ASSOC COMPUTING MACHINERY

Intra-process memory isolation is a well-known technique to enforce least privilege within a process. In this paper, we propose a generic and efficient intra-process memory isolation technique named PANIC, by leveraging Privileged Access Never (PAN) and load/store unprivileged (LSU) instructions on AArch64. PANIC executes process code in kernel mode and compartments code into trusted and untrusted components. The untrusted code is restricted from accessing the isolated memory region, which is located on user pages, and the trusted code is allowed to access the isolated memory region by using LSU instructions. To mitigate threats induced by running user code in kernel mode, PANIC provides two novel security mechanisms: shim-based memory isolation and sensitive instruction emulation. PANIC provides a generic and efficient isolation primitive that can be applied in three different isolation scenarios: protecting sensitive data in CFI, creating isolated execution environments, and hardening JIT code cache. We have implemented a prototype of PANIC and experimental evaluation shows that PANIC incurs very low performance overhead, and performs better than existing methods.

Intra-process Memory Isolation ARM LSU UAO PAN Isolated Execution Environment

其他

英语

CPCI-S

National Natural Science Foundation of China (NSFC)["61902374","62272442","U1736208"] ; Innovation Funding of ICT, CAS[E161040]

Computer Science ; Telecommunications

Computer Science, Artificial Intelligence ; Computer Science, Interdisciplinary Applications ; Telecommunications

WOS:001124987200063

Web of Science

1.SKLP, Institute of Computing Technology, CAS University of Chinese Academy of Sciences
2.Department of Computer Science and Engineering, SUSTech Research Institute of Trustworthy Autonomous Systems, SUSTech
3.University of Chinese Academy of Sciences
4.Peking University
5.National Digital Switching System Engineering and Technological Research Center

Jiali Xu,Mengyao Xie,Chenggang Wu,et al. PANIC: PAN-assisted Intra-process Memory Isolation on ARM[C]. 1601 Broadway, 10th Floor, NEW YORK, NY, UNITED STATES:ASSOC COMPUTING MACHINERY,2023.