Security vulnerability mitigation using hardware-supported context-dependent address space hiding
A system, method and processor that mitigates security vulnerabilities using context-dependent address space hiding. In some embodiments, a hardware mechanism allows a more-privileged software component managing multiple less-privileged software components to blind itself against “out-of-context” less-privileged software components. The hardware mechanism can allow the more-privileged software component to dynamically hide a portion of the more-privileged address space related to the “out-of-context” less-privileged software components, based on knowledge of the “in-context” less-privileged software component. A context register is set with a value from which an address range, within the address space of the more-privileged software component, can be determined, where the address range is associated with a first less-privileged software component can be determined. When the more-privileged software component attempts to access data from other less-privileged software components, it is prevented from accessing such data, based at least in part on the context register.
1 . A device, comprising:
one or more hardware registers; and
address translation circuitry configured to translate, for memory access instructions, addresses in a virtual address space to addresses in a physical address space for accessing physical memory, wherein the virtual address space comprises a plurality of portions of different privilege levels including a lower privilege level and a higher privilege level, and wherein to translate an address in the virtual address space for a memory access, the address translation circuitry is configured to:
determine whether to apply context dependent memory access security;
responsive to a determination to apply context dependent memory access security, determine, based on contents of the one or more hardware registers, whether the address in the virtual address space is within a subset of one or more portions of the virtual address space of the lower privilege level;
responsive to a determination the address in the virtual address space is within the subset of the one or more portions of the virtual address space of the lower privilege level, allow translation of the address in the virtual address space to an address in the physical address space; and
responsive to a determination the address in the virtual address space is not within the subset of the one or more portions of the virtual address space of the lower privilege level, block the memory access.
2 . The device of claim 1 , wherein to translate the address in the virtual address space for the memory access, the address translation circuitry is configured to:
responsive to a determination to not apply context dependent memory access security, allow translation of the address in the virtual address space to the address in the physical address space.
3 . The device of claim 1 , further comprising:
one or more hardware execution units configured to execute program instructions for a more-privileged software component and a plurality of less-privileged software components, wherein the more-privileged software component has a higher memory access privilege than respective memory access privileges of the plurality of less-privileged software components, and wherein the more-privileged software component is configured to perform management tasks on behalf of the plurality of less-privileged software components using management data at one or more portions of a virtual address space to which the more-privileged software component has access according to the higher memory access privilege.
4 . The device of claim 3 , wherein to translate the address in the virtual address space for the memory access, the address translation circuitry is configured to:
determine whether the address in the virtual address space is within another one or more portions of the virtual address space used by the more-privileged software component; and
responsive to a determination that the address in the virtual address space is not within the other one or more portions of the virtual address space, allow translation of the address in the virtual address space to an address in the physical address space;
wherein to determine whether the address in the virtual address space is within the subset of the one or more portions of the virtual address space is responsive to the determination to apply context dependent memory access security and responsive to the determination that the address in the virtual address space is within the other one or more portions of the virtual address space used by the more-privileged software component.
5 . The device of claim 3 , wherein to translate the address in the virtual address space for the memory access, the address translation circuitry is configured to:
determine whether the address in the virtual address space is within another one or more portions of the virtual address space used by the more-privileged software component; and
responsive to a determination that the address in the virtual address space is not within the other one or more portions of the virtual address space, allow translation of the address in the virtual address space to an address in the physical address space;
wherein to determine whether to apply the context dependent memory access security is responsive to the determination that the address in the virtual address space is within the other one or more portions of the virtual address space used by the more-privileged software component.
6 . The device of claim 3 , wherein the one or more hardware registers comprise:
a first hardware register for storing location information for the one or more portions of the virtual address space used by the more-privileged software component; and
a second hardware register for storing an identifier for one of the plurality of less-privileged software components for which the more-privileged software component is to perform a management task, wherein the identifier maps to a subset of the one or more portions of the virtual address space;
wherein the determination to apply context dependent memory access security is based on contents of the first and second hardware registers.
7 . The device of claim 6 , wherein the one or more hardware registers further comprise a third hardware register for storing a fixed size of subsets of the one or more portions of the virtual address space, including the subset, used by the more-privileged software component to store the management data for performing the management tasks on behalf of individual less-privileged software components of the plurality of less-privileged software components, and wherein to determine whether the address in the virtual address space is within the subset of the one or more portions of the virtual address space, the address translation circuitry is further configured to:
determine a beginning virtual address, of the subset of the one or more portions of the virtual address space, by multiplying the third register with the second register and adding a result of the multiplication to the first register;
determine an ending virtual address by adding the second register to the beginning virtual address; and
determine whether the address in the virtual address space is between the beginning virtual address and the ending virtual address.
8 . A system, comprising:
one or more processors individually comprising:
one or more hardware registers; and
address translation circuitry configured to translate, for memory access instructions, addresses in a virtual address space to addresses in a physical address space for accessing physical memory, wherein the virtual address space comprises a plurality of portions of different privilege levels including a lower privilege level and a higher privilege level, and wherein to translate an address in the virtual address space for a memory access, the address translation circuitry is configured to:
determine whether to apply context dependent memory access security;
responsive to a determination to apply context dependent memory access security, determine, based on contents of the one or more hardware registers, whether the address in the virtual address space is within a subset of one or more portions of the virtual address space of the lower privilege level;
responsive to a determination the address in the virtual address space is within the subset of the one or more portions of the virtual address space of the lower privilege level, allow translation of the address in the virtual address space to an address in the physical address space; and
responsive to a determination the address in the virtual address space is not within the subset of the one or more portions of the virtual address space of the lower privilege level, block the memory access.
9 . The system of claim 8 , wherein to translate the address in the virtual address space for the memory access, the address translation circuitry is configured to:
responsive to a determination to not apply context dependent memory access security, allow translation of the address in the virtual address space to the address in the physical address space.
10 . The system of claim 8 , wherein the one or more processors further individually comprise:
one or more hardware execution units configured to execute program instructions for a more-privileged software component and a plurality of less-privileged software components, wherein the more-privileged software component has a higher memory access privilege than respective memory access privileges of the plurality of less-privileged software components, and wherein the more-privileged software component is configured to perform management tasks on behalf of the plurality of less-privileged software components using management data at one or more portions of a virtual address space to which the more-privileged software component has access according to the higher memory access privilege.
11 . The system of claim 10 , wherein to translate the address in the virtual address space for the memory access, the address translation circuitry is configured to:
determine whether the address in the virtual address space is within another one or more portions of the virtual address space used by the more-privileged software component; and
responsive to a determination that the address in the virtual address space is not within the other one or more portions of the virtual address space, allow translation of the address in the virtual address space to an address in the physical address space;
wherein to determine whether the address in the virtual address space is within the subset of the one or more portions of the virtual address space is responsive to the determination to apply context dependent memory access security and responsive to the determination that the address in the virtual address space is within the other one or more portions of the virtual address space used by the more-privileged software component.
12 . The system of claim 10 , wherein to translate the address in the virtual address space for the memory access, the address translation circuitry is configured to:
determine whether the address in the virtual address space is within another one or more portions of the virtual address space used by the more-privileged software component; and
responsive to a determination that the address in the virtual address space is not within the other one or more portions of the virtual address space, allow translation of the address in the virtual address space to an address in the physical address space;
wherein to determine whether to apply the context dependent memory access security is responsive to the determination that the address in the virtual address space is within the other one or more portions of the virtual address space used by the more-privileged software component.
13 . The system of claim 10 , wherein the one or more hardware registers comprise:
a first hardware register for storing location information for the one or more portions of the virtual address space used by the more-privileged software component; and
a second hardware register for storing an identifier for one of the plurality of less-privileged software components for which the more-privileged software component is to perform a management task, wherein the identifier maps to a subset of the one or more portions of the virtual address space;
wherein the determination to apply context dependent memory access security is based on contents of the first and second hardware registers.
14 . The system of claim 13 , wherein the one or more hardware registers further comprise a third hardware register for storing a fixed size of subsets of the one or more portions of the virtual address space, including the subset, used by the more-privileged software component to store the management data for performing the management tasks on behalf of individual less-privileged software components of the plurality of less-privileged software components, and wherein to determine whether the address in the virtual address space is within the subset of the one or more portions of the virtual address space, the address translation circuitry is further configured to:
determine a beginning virtual address, of the subset of the one or more portions of the virtual address space, by multiplying the third register with the second register and adding a result of the multiplication to the first register;
determine an ending virtual address by adding the second register to the beginning virtual address; and
determine whether the address in the virtual address space is between the beginning virtual address and the ending virtual address.
15 . A method, comprising:
translating, in address translation circuitry of a processor on behalf of memory access instructions addresses in a virtual address space to addresses in a physical address space for accessing physical memory, wherein the virtual address space comprises a plurality of portions of different privilege levels including a lower privilege level and a higher privilege level, and wherein translating an address in the virtual address space for a memory access comprises:
determining whether to apply context dependent memory access security;
responsive to determining to apply context dependent memory access security, determining, based on contents of one or more hardware registers, whether the address in the virtual address space is within a subset of one or more portions of the virtual address space of the lower privilege level;
responsive to determining the address in the virtual address space is within the subset of the one or more portions of the virtual address space of the lower privilege level, allowing translation of the address in the virtual address space to an address in the physical address space; and
responsive to determining the address in the virtual address space is not within the subset of the one or more portions of the virtual address space of the lower privilege level, blocking the memory access.
16 . The method of claim 15 , wherein translating the address in the virtual address space for the memory access comprises:
responsive to determining to not apply context dependent memory access security, allowing translation of the address in the virtual address space to the address in the physical address space.
17 . The method of claim 15 , further comprising executing program instructions for a more-privileged software component and a plurality of less-privileged software components, wherein the more-privileged software component has a higher memory access privilege than respective memory access privileges of the plurality of less-privileged software components, and wherein the more-privileged software component is configured to perform management tasks on behalf of the plurality of less-privileged software components using management data at one or more portions of a virtual address space to which the more-privileged software component has access according to the higher memory access privilege.
18 . The method of claim 17 , wherein translating the address in the virtual address space for the memory access comprises:
determining whether the address in the virtual address space is within another one or more portions of the virtual address space used by the more-privileged software component; and
responsive to a determining that the address in the virtual address space is not within the other one or more portions of the virtual address space, allowing translation of the address in the virtual address space to an address in the physical address space;
wherein determining whether the address in the virtual address space is within the subset of the one or more portions of the virtual address space is performed responsive to determining to apply context dependent memory access security and responsive to determining that the address in the virtual address space is within the other one or more portions of the virtual address space used by the more-privileged software component.
19 . The method of claim 17 , wherein translating the address in the virtual address space for the memory access comprises:
determining whether the address in the virtual address space is within another one or more portions of the virtual address space used by the more-privileged software component; and
responsive to determining that the address in the virtual address space is not within the other one or more portions of the virtual address space, allowing translation of the address in the virtual address space to an address in the physical address space;
wherein determining whether to apply the context dependent memory access security is performed responsive to determining that the address in the virtual address space is within the other one or more portions of the virtual address space used by the more-privileged software component.
20 . The method of claim 17 , wherein determining whether the address in the virtual address space is within the subset of the one or more portions of the virtual address space comprises:
determining a beginning virtual address, of the subset of the one or more portions of the virtual address space, by multiplying a third register with a second register and adding a result of the multiplication to a first register, the first hardware register storing location information for the one or more portions of the virtual address space used by the more-privileged software component, the second hardware register storing an identifier for one of the plurality of less-privileged software components for which the more-privileged software component is to perform a management task, wherein the identifier maps to a subset of the one or more portions of the virtual address space and the third hardware register storing a fixed size of subsets of the one or more portions of the virtual address space, including the subset, used by the more-privileged software component to store the management data for performing the management tasks on behalf of individual less-privileged software components of the plurality of less-privileged software components;
determining an ending virtual address by adding the second register to the beginning virtual address; and
determining whether the address in the virtual address space is between the beginning virtual address and the ending virtual address.