KPDP: Kernel Permission Data Protection Against Data-Oriented Attacks

Data-oriented attacks are increasingly becoming a practical and effective way to bypass the access control mechanisms in the modern operating system. Attackers exploit the memory corruption vulnerability to conduct a data-oriented attack aimed at the non-control data used in the access control model (hereafter referred to as “Permission Data”) for privilege escalation. However, a practical and effective mitigation scheme against Data-oriented attacks in the kernel remains an open problem. In this paper, we provide a solution called KPDP, a Kernel Permission Data Protection (KPDP) mechanism that protects different types of kernel permission data against data-oriented attacks leveraging virtualization technology. KPDP enforces the integrity of kernel permission structures and their pointers. It isolates kernel permission data to a read-only memory region and restricts memory access to structure and pointer based on specific policies. The security analysis results show that KPDP is effective in preventing privilege escalation against data-oriented attacks.