System and method for kernel rootkit protection in a hypervisor environment
View Patent ↗A method includes creating a soft whitelist having an entry corresponding to a first guest kernel page in a guest operating system (OS) in a hypervisor environment including a hypervisor. The method also includes receiving an access attempt to a second guest kernel page, and generating a page fault when the access attempt is made to the second guest kernel page. In addition, the method includes determining that the second guest kernel page does not correspond to the entry in the soft whitelist, and denying an execution of the second guest kernel page if the second guest kernel page does not correspond to the entry in the soft whitelist.
1. A method, comprising:
creating a soft whitelist having an entry corresponding to a first guest kernel page in a guest operating system (OS) in a hypervisor environment comprising a hypervisor;
receiving an access attempt to a second guest kernel page;
generating a page fault when the access attempt is made to the second guest kernel page;
determining whether the second guest kernel page corresponds to the entry in the soft whitelist;
fixing the page fault to allow an access and execution of the second guest kernel page if the second guest kernel page corresponds to the entry in the soft whitelist; and
denying an execution of the second guest kernel page if the second guest kernel page does not correspond to the entry in the soft whitelist.
2. The method of claim 1 , further comprising:
marking the first guest kernel page as read-only and executable if the page fault is an instruction page fault and the second guest kernel page corresponds to the entry in the soft whitelist.
3. The method of claim 1 , further comprising:
if the page fault is a data page fault and the second guest kernel page does not correspond to the entry in the soft whitelist:
fixing the page fault; and
marking the second guest kernel page as non-executable.
4. The method of claim 1 , wherein the creating the soft whitelist comprises adding a machine page frame number (MFN) corresponding to a virtual address of the first guest kernel page into a hash.
5. The method of claim 1 , further comprising:
marking a page table entry (PTE) corresponding to the first guest kernel page as NOT_PRESENT in a shadow page table of the hypervisor.
6. The method of claim 5 , wherein
the denying the execution comprises one of:
causing the guest OS to loop;
injecting an exception in the guest OS; or
fixing the page fault and pointing a corresponding PTE in the shadow page table to a crafted page instead of the second guest kernel page, wherein the crafted page comprises code that either causes the guest OS to crash or executes a set of No Operations (NOP) instructions.
7. The method of claim 1 , wherein the creating the soft whitelist is performed after the guest OS has loaded substantially all its kernel components at boot.
8. The method of claim 1 , wherein the creating the soft whitelist is performed before the guest OS has loaded substantially all its kernel components, and the first guest kernel page is from a paged pool range or a non-paged pool range.
9. The method of claim 1 , further comprising:
setting a lockdown feature bit in the hypervisor during domain creation to enable rootkit protection.
10. An apparatus, comprising:
a memory;
a processor; and
a hypervisor, such that the apparatus is configured for
creating a soft whitelist having an entry corresponding to a first guest kernel page in a guest operating system (OS) in a hypervisor environment comprising the hypervisor;
receiving an access attempt to a second guest kernel page;
generating a page fault when the access attempt is made to the second guest kernel page;
determining whether the second guest kernel page corresponds to the entry in the soft whitelist;
fixing the page fault to allow an access and execution of the second guest kernel page if the second guest kernel page corresponds to the entry in the soft whitelist; and
denying an execution of the second guest kernel page if the second guest kernel page does not correspond to the entry in the soft whitelist.
11. The apparatus of claim 10 , wherein the apparatus is further configured for:
marking the first guest kernel page as read-only and executable if the page fault is an instruction page fault and the second guest kernel page corresponds to the entry in the soft whitelist.
12. The apparatus of claim 10 , wherein the apparatus is further configured for:
if the page fault is a data page fault and the second guest kernel page does not correspond to the entry in the soft whitelist:
fixing the page fault; and
marking the second guest kernel page as non-executable.
13. The apparatus of claim 10 , wherein the creating the soft whitelist comprises adding a machine page frame number (MFN) corresponding to a virtual address of the first guest kernel page into a hash.
14. The apparatus of claim 10 , wherein
the denying the execution comprises one of:
causing the guest OS to loop;
injecting an exception in the guest OS; or
fixing the page fault and pointing a corresponding PTE in a shadow page table of the hypervisor to a crafted page instead of the second guest kernel page, wherein the crafted page comprises code that either causes the guest OS to crash or executes a set of No Operations (NOP) instructions.
15. Logic encoded in non-transitory media that includes code for execution and, when executed by a processor, is operable to perform operations comprising:
creating a soft whitelist having an entry corresponding to a first guest kernel page in a guest operating system (OS) in a hypervisor environment comprising a hypervisor;
receiving an access attempt to a second guest kernel page;
generating a page fault when the access attempt is made to the second guest kernel page;
determining whether the second guest kernel page corresponds to the entry in the soft whitelist;
fixing the page fault to allow an access and execution of the second guest kernel page if the second guest kernel page corresponds to the entry in the soft whitelist; and
denying an execution of the second guest kernel page if the second guest kernel page does not correspond to the entry in the soft whitelist.
16. The logic of claim 15 , the operations further comprising:
marking the first guest kernel page as read-only and executable if the page fault is an instruction page fault and the second guest kernel page corresponds to the entry in the soft whitelist.
17. The logic of claim 15 , the operations further comprising:
if the page fault is a data page fault and the second guest kernel page does not correspond to the entry in the soft whitelist:
fixing the page fault; and
marking the second guest kernel page as non-executable.
18. The logic of claim 15 , wherein the creating the soft whitelist comprises adding a machine page frame number (MFN) corresponding to a virtual address of the first guest kernel page into a hash.
19. The logic of claim 15 , the operations further comprising:
marking a PTE corresponding to the first guest kernel page as NOT_PRESENT in a shadow page table of the hypervisor.
20. The logic of claim 19 , wherein
the denying the execution comprises one of:
causing the guest OS to loop;
injecting an exception in the guest OS; or
fixing the page fault and pointing a corresponding PTE in the shadow page table to a crafted page instead of the second guest kernel page, wherein the crafted page comprises code that either causes the guest OS to crash or execute a set of No Operations (NOP) instructions.