.png){kind=icon}
.png){kind=icon}
Return
Hardware-Assisted Live Kernel Function Updating on Intel Platforms
.png){kind=icon}
OA
AI
DOI：10.1109/TDSC.2023.3300101.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Traditional kernel updates such as perfective maintenance and vulnerability patching requires shutting the system down, disrupting continuous execution of applications. Enterprises and researchers have proposed various live updating techniques to patch the kernel with lower downtime to reduce the loss of useful uptime. However, existing kernel live update techniques either rely on specific support from the target OS, or are deployed in virtualized environments (i.e., systems running in virtual machines). In this article we present KSHOT, a hardware-assisted live and secure kernel function update mechanism for native operating systems. By leveraging x86 SMM and Intel SGX, KSHOT runs in hardware-assisted Trusted Execution Environments and updates kernel functions at the binary-level without relying on the underlying OS support. We demonstrate the applicability of KSHOT by successfully patching critical kernel vulnerabilities, upgrading base kernel functions and drivers nearly instantly and transparently. Our experimental results show that KSHOT incurs merely 70 microseconds downtime to update a one kilobyte binary and 18 MB memory overhead.
Keywords:
Kernel function updating
system management mode
trusted execution environment
consistency
transparency
Kernel function updating
system management mode
trusted execution environment
consistency
transparency
Journal
IF:
7.5
Papers:
2.4K
Citations:
9.6K
Organization
View more organizations