potential vulnerability about perspicuos

[ndauten]

Hi @gezedo:

Thanks for the complements!

As per the security issue of WP bit being set: great observation! In our design we take this into account, but our implementation does not.

The solution is expressed as Invariant I9 and described in Section 3.7 of the Nested Kernel APSLOS paper.

The quick answer for how we address the problem is to ensure that all instances of instructions that modify cr0 have an identity mapping to nested kernel code. So effectively there may be a move to cr0 at some virtual address Vc. We ensure that the physical address Vc is a nested kernel controlled function that will check for such situations.

But I do want to make it clear that our current implementation does not do this and is thus insecure to this attack.

Please let me know if you have any other questions.

[gezedo]

Thanks for clarification.
While I am not very familiar with neither x86 nor FreeBSD arch (I am more focused on ARM/Linux), I have a few other questions:

• Can interrupts happens when the outer kernel runs (I assume yes) ?
• Might interrupt processing path execute outer kernel code (with WP bit enabled, of course) ?
• Is the interrupted context saved in a secure location (protected from outer kernel writes) ?

[ndauten]

Hi @gezedo

Sorry for my delay in responding: I'm completing my dissertation right now so future responses may be a bit delayed.

re: interrupts> Interrupts can occur while the outer kernel is in execution

re: wp-disabled on interrupts> Interrupts go through a nested kernel handler before any control is passed to the outer kernel. On each path the outer kernel the nested kernel enables the WP-bit.

re: interrupt context> The nested kernel operates atomically: interrupts are disabled and complete all required tasks: it never goes to the outer kernel and back to finish. Therefore, there is never any context that must be kept between invocations to the nested kernel. There is of course state in the nested kernel that persists, but this is all protected by readonly MMU policies.

Best,
::nathan::