Patch Auditing in Infrastructure as a Service Clouds

A basic requirement of a secure computer system is that it be up to date with regard to software security patches. Unfortunately, Infras-tructure as a Service (IaaS) clouds make this difficult. They lever-age virtualization, which provides functionality that causes tradi-tional security patch update systems to fail. In addition, the diver-sity of operating systems and the distributed nature of administra-tion in the cloud compound the problem of identifying unpatched machines. In this work, we propose P2, a hypervisor-based patch audit solution. P2 audits VMs and detects the execution of unpatched binary and non-binary files in an accurate, continuous and OS-agnostic manner. Two key innovations make P2 possible. First, P2 uses efficient information flow tracking to identify the use of un-patched non-binary files in a vulnerable way. We performed a patch survey and discover that 64 % of files modified by security updates do not contain binary code, making the audit of non-binary files crucial. Second, P2 implements a novel algorithm that identifies binaries in mid-execution to allow handling of VMs resumed from a checkpoint or migrated into the cloud. We have implemented a prototype of P2 and and our experi-ments show that it accurately reports the execution of unpatched code while imposing performance overhead of 4%