1. 1 Multiprocessors May Reduce System Dependability Under File-based Race Condition Attacks Jinpeng Wei, Calton Pu Georgia Institute of Technology Atlanta, Georgia, USA Presented on DSN-DCCS June 28, 2007

2. 2 System Dependability: Brief History Traditionally focused on availability and reliability (have redundancy, keep running) Traditionally focused on availability and reliability (have redundancy, keep running) Now security and safety are urgent issues Now security and safety are urgent issues  Widely deployed software systems have bugs  Software systems are under constant attacks. intended behavior != actual behavior

3. 3 Multiprocessors: Boon or Bane? Definitely they are good Definitely they are good  Better performance  Lower power consumption  More secure: Intrusion detection systems Unless they fall in bad hands... Unless they fall in bad hands...  Attacker can become faster in a race condition attack, thus making the system less secure.

4. 4 It ’ s Much Easier to Attack TOCTTOU Vulnerabilities on Multiprocessors

5. 5 Agenda Background about TOCTTOU and the vulnerabilities with vi and gedit Background about TOCTTOU and the vulnerabilities with vi and gedit A probabilistic model for TOCTTOU attacks A probabilistic model for TOCTTOU attacks Probability analysis of exploiting vi Probability analysis of exploiting vi Probability and event analysis of exploiting gedit Probability and event analysis of exploiting gedit Parallelizing the attack program on a multiprocessor Parallelizing the attack program on a multiprocessor Conclusion Conclusion

6. 6 Definition and Scope TOCTTOU – Time of Check To Time of Use, a kind of file-based race condition in Unix-style systems TOCTTOU – Time of Check To Time of Use, a kind of file-based race condition in Unix-style systems Check – Establish some precondition (invariant) about a file Check – Establish some precondition (invariant) about a file Use – Operate on the file assuming that the invariant is still valid Use – Operate on the file assuming that the invariant is still valid

7. 7 Sendmail Example /home/abc/mailbox a symbolic link? No Yes Error handling Check Use Run as root Run as root Operate on files owned by normal users Operate on files owned by normal users Establishing the invariant: /home/abc/mailbox is NOT a symbolic link Assuming the invariant still holds Append the new message to /home/abc/mailbox

8. 8 Sendmail Vulnerability: An Example Append the new message to /home/abc/mailbox (actually to /etc/passwd) Delete /home/abc/mailbox Create symbolic link mailbox, pointing to /etc/passwd Sendmail (root)Attacker (abc) Time No Effect: The attacker may get unauthorized root access! /home/abc/mailbox a symbolic link? Check Use

9. 9 TOCTTOU Vulnerabilities in Red Hat Linux 9 [1] ApplicationTOCTTOU errors Possible exploit vi Changing the owner of /etc/passwd to an ordinary user gedit Changing the owner of /etc/passwd to an ordinary user rpm Running arbitrary command emacs Making /etc/shadow readable by an ordinary user Tested: ~130 utilities from /bin, /sbin and /usr/bin [1] Jinpeng Wei, Calton Pu. FAST’05

10. 10 vi 6.1 Vulnerability The vulnerability happens when The vulnerability happens when  vi is run by root  vi is editing a file owned by a normal user (also the attacker)  vi saves the file being edited TOCTTOU pair: TOCTTOU pair:  open creates a new file for writing  chown changes the owner of the new file to the normal user. while ((fd = mch_open((char *)wfname, …) …… chown((char*)wfname, st_old.st_uid, st_old.st_gid);

11. 11 gedit 2.8.3 Vulnerability Similar to the vi vulnerability Similar to the vi vulnerability  gedit is run by root  gedit is editing a file owned by a normal user (also the attacker)  gedit saves the file being edited TOCTTOU pair: TOCTTOU pair:  rename creates a new file  chown changes the owner of the new file to the normal user. /*create and write to temp_filename …*/ if (rename (temp_filename, real_filename) != 0){ … } chmod (real_filename, st.st_mode); chown (real_filename, st.st_uid, st.st_gid);

12. 12 An Attack Program 1 while (!finish){ 2 if (stat(filename, &stbuf) == 0){ 3 if ((stbuf.st_uid == 0) && (stbuf.st_gid == 0)) 4 { 5 unlink(filename); 6 symlink(“/etc/passwd”, filename); 7 finish = 1; 8 } 9 } 10 } Observation: the file owner temporarily becomes root during the vulnerability window. Observation: the file owner temporarily becomes root during the vulnerability window. Simple, brutal-force. Simple, brutal-force.

13. 13 Event Analysis of vi Exploit on a Uniprocessor

14. 14 Agenda Background about TOCTTOU and the vulnerabilities with vi and gedit Background about TOCTTOU and the vulnerabilities with vi and gedit A probabilistic model for TOCTTOU attacks A probabilistic model for TOCTTOU attacks Probability analysis of exploiting vi Probability analysis of exploiting vi Probability and event analysis of exploiting gedit Probability and event analysis of exploiting gedit Parallelizing the attack program on a multiprocessor Parallelizing the attack program on a multiprocessor Conclusion Conclusion

15. 15 Some Definitions for the Probabilistic Model Window of Vulnerability: the time interval between check and use (e.g., ). Window of Vulnerability: the time interval between check and use (e.g., ). Attack pattern: {detection} + [attack] Attack pattern: {detection} + [attack]  detection can be run 1 or more times  attack can be run 0 or 1 time Three process states Three process states  Suspended: unable to run (relinquishing CPU)  Scheduled: able to run (using CPU)  Finished: finished the attack actions (symbolic link replacement, etc)

16. 16 A Probabilistic Model for Predicting TOCTTOU Attack Success Rate P (attack succeeds) on a multiprocessor is not less than that on a uniprocessor, because of the second part of the equation. P (attack succeeds) on a multiprocessor is not less than that on a uniprocessor, because of the second part of the equation.  P (attack scheduled | victim not suspended) = 0 on a uniprocessor Success gain due to the second part may become significant when P (victim suspended) is very small. Success gain due to the second part may become significant when P (victim suspended) is very small. But wait, can the attack finished? But wait, can the attack finished? P (attack succeeds) = P (victim suspended) * P (attack scheduled | victim suspended) * P (attack finished | victim suspended) + P (victim not suspended) * P (attack scheduled | victim not suspended) * P (attack finished | victim not suspended)

17. 17 P (attack finished | victim not suspended) D = detection time, L = t2 - t1 (Laxity) D = detection time, L = t2 - t1 (Laxity) t1 = the earliest start time for a successful detection t1 = the earliest start time for a successful detection t2 = the latest start time for a successful detection leading to a successful attack t2 = the latest start time for a successful detection leading to a successful attack The answer =

18. 18 Agenda Background about TOCTTOU and the vulnerabilities with vi and gedit Background about TOCTTOU and the vulnerabilities with vi and gedit A probabilistic model for TOCTTOU attacks A probabilistic model for TOCTTOU attacks Probability analysis of exploiting vi Probability analysis of exploiting vi Probability and event analysis of exploiting gedit Probability and event analysis of exploiting gedit Parallelizing the attack program on a multiprocessor Parallelizing the attack program on a multiprocessor Conclusion Conclusion

19. 19 Success Rate of Attacking Vi on a Uniprocessor Between 1.5% and 18% Between 1.5% and 18% Approaches 0 when file size approaches 0 Approaches 0 when file size approaches 0 while ((fd = mch_open((char *)wfname, …) /* writing to wfname using fd…*/ chown((char*)wfname, st_old.st_uid, st_old.st_gid);

20. 20 100% for files with size >=20KB 100% for files with size >=20KB L >> D L >> D Success Rate of Attacking Vi on a SMP 96% for files with 1 byte 96% for files with 1 byte L and D become close L and D become close Attack may not be scheduled Attack may not be scheduled

21. 21 Agenda Background about TOCTTOU and the vulnerabilities with vi and gedit Background about TOCTTOU and the vulnerabilities with vi and gedit A probabilistic model for TOCTTOU attacks A probabilistic model for TOCTTOU attacks Probability analysis of exploiting vi Probability analysis of exploiting vi Probability and event analysis of exploiting gedit Probability and event analysis of exploiting gedit Parallelizing the attack program on a multiprocessor Parallelizing the attack program on a multiprocessor Conclusion Conclusion

22. 22 gedit Attack Success Rates 0 on a uniprocessor 0 on a uniprocessor 83% on a SMP (2 x 1.7G CPUs, 512MB memory) 83% on a SMP (2 x 1.7G CPUs, 512MB memory) The delay between rename and chmod is an important contributing factor to L. It is 43 microseconds on the SMP. The delay between rename and chmod is an important contributing factor to L. It is 43 microseconds on the SMP. Table: L and D values in microseconds (SMP) if (rename (temp_filename, real_filename) != 0){ … } chmod (real_filename, st.st_mode); chown (real_filename, st.st_uid, st.st_gid);

23. 23 gedit Attack on a Multicore 2 x 3.2G dual-core CPUs with HT, 4GB memory 2 x 3.2G dual-core CPUs with HT, 4GB memory No success at all ! No success at all ! Why ? Why ?

24. 24 New Observation on the gedit Attack CPU is a necessary but not sufficient condition for a successful attack CPU is a necessary but not sufficient condition for a successful attack Semaphore on the shared file is another necessary condition Semaphore on the shared file is another necessary condition  The race between gedit and the attacker for the semaphore decides the attack result The delay between stat and unlink of the attacker is 17 us. The delay between stat and unlink of the attacker is 17 us. The delay between rename and chmod is now only 3 us. The delay between rename and chmod is now only 3 us. There is a 6 us trap (due to page fault) within the 17 us of the attacker. There is a 6 us trap (due to page fault) within the 17 us of the attacker.

25. 25 Rethinking the gedit Attack Program There is a trap when the true branch of statement 3 is taken, because unlink is never invoked before by the attacker … There is a trap when the true branch of statement 3 is taken, because unlink is never invoked before by the attacker … Linux kernel dynamically maps shard libraries (e.g., libc) into an application ’ s address space. Linux kernel dynamically maps shard libraries (e.g., libc) into an application ’ s address space. 1 while (!finish){ 2 if (stat(filename, &stbuf) == 0){ 3 if ((stbuf.st_uid == 0) && (stbuf.st_gid == 0)) 4 { 5 unlink(filename); 6 symlink(“/etc/passwd”, filename); 7 finish = 1; 8 } 9 } 10 }

26. 26 The Solution … Proactively invoke unlink to remove the trap. Proactively invoke unlink to remove the trap. 1 while (!finish){ /* argv[1] holds filename */ 2 if (stat(argv[1], &stbuf) == 0){ 3 if ((stbuf.st_uid == 0) && (stbuf.st_gid == 0)) 4 { 5 fname = argv[1]; 6 finish = 1; 7 } 8 else 9 fname = dummy; 10 11 unlink(fname); 12 symlink(“/etc/passwd”, fname); 13 }//if stat(argv[1].. 14 }//while

27. 27 New gedit Attack on a Multicore Started to see successes. Started to see successes. The trap disappeared The trap disappeared

28. 28 Agenda Background about TOCTTOU and the vulnerabilities with vi and gedit Background about TOCTTOU and the vulnerabilities with vi and gedit A probabilistic model for TOCTTOU attacks A probabilistic model for TOCTTOU attacks Probability analysis of exploiting vi Probability analysis of exploiting vi Probability and event analysis of exploiting gedit Probability and event analysis of exploiting gedit Parallelizing the attack program on a multiprocessor Parallelizing the attack program on a multiprocessor Conclusion Conclusion

29. 29 Pipelining Attack Program symlink needs not wait on the completion of unlink, so we can make the attack program multi-threaded symlink needs not wait on the completion of unlink, so we can make the attack program multi-threaded The attack can finish much earlier when the shared file is large, giving advantage when the vulnerability window is very small The attack can finish much earlier when the shared file is large, giving advantage when the vulnerability window is very small

30. 30 Conclusion A probabilistic model for TOCTTOU attacks which captures the reduced system dependability by the deployment of multiprocessors A probabilistic model for TOCTTOU attacks which captures the reduced system dependability by the deployment of multiprocessors Probability measurement and event analysis of exploiting vi and gedit, which corroborate the model and demonstrate how the attacker may utilize multiprocessors to achieve higher success rate. Probability measurement and event analysis of exploiting vi and gedit, which corroborate the model and demonstrate how the attacker may utilize multiprocessors to achieve higher success rate.