Randomization can’t stop BPF JIT spray

Elena Reshetova; Filippo Bonazzi; N. Asokan

doi:10.1007/978-3-319-64701-2_17

Randomization can’t stop BPF JIT spray

Elena Reshetova^*, Filippo Bonazzi, N. Asokan

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Scientific › peer-review

1 Citation (Scopus)

Abstract

The Linux kernel Berkeley Packet Filter (BPF) and its Just-In-Time (JIT) compiler are actively used in various pieces of networking equipment where filtering speed is especially important. In 2012, the Linux BPF/JIT compiler was shown to be vulnerable to a JIT spray attack; fixes were quickly merged into the Linux kernel in order to stop the attack. In this paper we show two modifications of the original attack which still succeed on a modern 4.4 Linux kernel, and demonstrate that JIT spray is still a major problem for the Linux BPF/JIT compiler. This work helped to make the case for further and proper countermeasures to the attack, which have then been merged into the 4.7 Linux kernel.

Original language	English
Title of host publication	Network and System Security - 11th International Conference, NSS 2017, Proceedings
Publisher	Springer
Pages	233-247
Number of pages	15
Volume	10394 LNCS
ISBN (Print)	9783319647005
DOIs	https://doi.org/10.1007/978-3-319-64701-2_17
Publication status	Published - 2017
MoE publication type	A4 Article in a conference publication
Event	International Conference on Network and System Security - Helsinki, Helsinki, Finland Duration: 21 Aug 2017 → 23 Aug 2017 Conference number: 11

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	10394 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	International Conference on Network and System Security
Abbreviated title	NSS
Country/Territory	Finland
City	Helsinki
Period	21/08/2017 → 23/08/2017

Keywords

Berkeley Packet Filter
JIT spray
Network security

Access to Document

10.1007/978-3-319-64701-2_17

OpenUrl availability

Full text

Cite this

Reshetova, E., Bonazzi, F., & Asokan, N. (2017). Randomization can’t stop BPF JIT spray. In Network and System Security - 11th International Conference, NSS 2017, Proceedings (Vol. 10394 LNCS, pp. 233-247). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10394 LNCS). Springer. https://doi.org/10.1007/978-3-319-64701-2_17

@inproceedings{379d9f534a094d6dbf2cc753548d198c,

title = "Randomization can{\textquoteright}t stop BPF JIT spray",

abstract = "The Linux kernel Berkeley Packet Filter (BPF) and its Just-In-Time (JIT) compiler are actively used in various pieces of networking equipment where filtering speed is especially important. In 2012, the Linux BPF/JIT compiler was shown to be vulnerable to a JIT spray attack; fixes were quickly merged into the Linux kernel in order to stop the attack. In this paper we show two modifications of the original attack which still succeed on a modern 4.4 Linux kernel, and demonstrate that JIT spray is still a major problem for the Linux BPF/JIT compiler. This work helped to make the case for further and proper countermeasures to the attack, which have then been merged into the 4.7 Linux kernel.",

keywords = "Berkeley Packet Filter, JIT spray, Network security",

author = "Elena Reshetova and Filippo Bonazzi and N. Asokan",

year = "2017",

doi = "10.1007/978-3-319-64701-2_17",

language = "English",

isbn = "9783319647005",

volume = "10394 LNCS",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "233--247",

booktitle = "Network and System Security - 11th International Conference, NSS 2017, Proceedings",

address = "Germany",

note = "International Conference on Network and System Security, NSS ; Conference date: 21-08-2017 Through 23-08-2017",

}

Reshetova, E, Bonazzi, F & Asokan, N 2017, Randomization can’t stop BPF JIT spray. in Network and System Security - 11th International Conference, NSS 2017, Proceedings. vol. 10394 LNCS, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 10394 LNCS, Springer, pp. 233-247, International Conference on Network and System Security, Helsinki, Finland, 21/08/2017. https://doi.org/10.1007/978-3-319-64701-2_17

Randomization can’t stop BPF JIT spray. / Reshetova, Elena; Bonazzi, Filippo; Asokan, N.
Network and System Security - 11th International Conference, NSS 2017, Proceedings. Vol. 10394 LNCS Springer, 2017. p. 233-247 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10394 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Scientific › peer-review

TY - GEN

T1 - Randomization can’t stop BPF JIT spray

AU - Reshetova, Elena

AU - Bonazzi, Filippo

AU - Asokan, N.

N1 - Conference code: 11

PY - 2017

Y1 - 2017

N2 - The Linux kernel Berkeley Packet Filter (BPF) and its Just-In-Time (JIT) compiler are actively used in various pieces of networking equipment where filtering speed is especially important. In 2012, the Linux BPF/JIT compiler was shown to be vulnerable to a JIT spray attack; fixes were quickly merged into the Linux kernel in order to stop the attack. In this paper we show two modifications of the original attack which still succeed on a modern 4.4 Linux kernel, and demonstrate that JIT spray is still a major problem for the Linux BPF/JIT compiler. This work helped to make the case for further and proper countermeasures to the attack, which have then been merged into the 4.7 Linux kernel.

AB - The Linux kernel Berkeley Packet Filter (BPF) and its Just-In-Time (JIT) compiler are actively used in various pieces of networking equipment where filtering speed is especially important. In 2012, the Linux BPF/JIT compiler was shown to be vulnerable to a JIT spray attack; fixes were quickly merged into the Linux kernel in order to stop the attack. In this paper we show two modifications of the original attack which still succeed on a modern 4.4 Linux kernel, and demonstrate that JIT spray is still a major problem for the Linux BPF/JIT compiler. This work helped to make the case for further and proper countermeasures to the attack, which have then been merged into the 4.7 Linux kernel.

KW - Berkeley Packet Filter

KW - JIT spray

KW - Network security

UR - http://www.scopus.com/inward/record.url?scp=85028469248&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-64701-2_17

DO - 10.1007/978-3-319-64701-2_17

M3 - Conference contribution

AN - SCOPUS:85028469248

SN - 9783319647005

VL - 10394 LNCS

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 233

EP - 247

BT - Network and System Security - 11th International Conference, NSS 2017, Proceedings

PB - Springer

T2 - International Conference on Network and System Security

Y2 - 21 August 2017 through 23 August 2017

ER -

Reshetova E, Bonazzi F, Asokan N. Randomization can’t stop BPF JIT spray. In Network and System Security - 11th International Conference, NSS 2017, Proceedings. Vol. 10394 LNCS. Springer. 2017. p. 233-247. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-64701-2_17

Randomization can’t stop BPF JIT spray

Abstract

Publication series

Conference

Keywords

Access to Document

OpenUrl availability

Other files and links

Fingerprint

Cite this