A Non-Inclusive Memory Permissions Architecture for Protection Against Cross-Layer Attacks

Protecting modern computer systems and complex software stacks against the growing range of possible attacks is be-coming increasingly difficult. The architecture of modern commodity systems allows attackers to subvert privileged sys-tem software often using a single exploit. Once the system is compromised, inclusive permissions used by current archi-tectures and operating systems easily allow a compromised high-privileged software layer to perform arbitrary malicious activities, even on behalf of other software layers. This paper presents a hardware-supported page permission scheme for the physical pages that is based on the concept of non-inclusive sets of memory permissions for different layers of system software such as hypervisors, operating systems, and user-level applications. Instead of viewing privilege lev-els as an ordered hierarchy with each successive level being more privileged, we view them as distinct levels each with its own set of permissions. Such a permission mechanism, imple-mented as part of a processor architecture, provides a common framework for defending against a range of recent attacks. We demonstrate that such a protection can be achieved with neg-ligible performance overhead, low hardware complexity and minimal changes to the commodity OS and hypervisor code. 1