Protecting Kernel Code Integrity with PMP on RISC-V

Kernel code integrity is the foundation of the security of the entire system. Attackers are motivated to compromise the kernel code integrity because it gives them the highest possible privilege on the system, allowing them to take the full control of it. They can perform the attack by either modifying the kernel code directly or tricking the kernel to execute from data pages. Existing kernels and processors are working together to defeat this threat, but their reliance on the page table leaves the attackers leeway to bypass the protection. Existing solutions aiming to tackle this limitation, the reliance on the page table integrity, are either too expensive or require custom hardware. In this paper, we present a software-only design of a kernel code integrity protection mechanism for RISC-V-based systems that implement the Physical Memory Protection (PMP). We show that, despite the lack of direct support for kernel code protection, the kernel and the machine mode firmware can work together to leverage the PMP to defeat the advanced kernel code integrity-compromising attacks by dynamically switching the memory protection policies on user-kernel switches. The performance estimation using our prototype shows that the proposed mechanisms incur moderate (<24%) overhead on system call latencies. The security evaluation using synthetic advanced attacks also demonstrates that the proposed mechanism can effectively prevent the page table-corrupting kernel code injection attacks.