在學習多執行緒程式設計 (Multi-Thread Programming) 的時候常常需要注意各執行緒 (thread) 之間是否有互相搶奪資源的狀況產生，也就是發生競爭條件 (Race Condition) 的情況，而 Double-Fetch 則是競爭條件的一個特殊案例。 Double-Fetch，顧名思義就是指兩次獲取資料。獲取這兩次資料的目的有些不同，第一次獲取資料可能是為了檢查資料的合法性，第二次則是正式使用這份資料，這是一種常見的開發思維。 在 Linux 中，不少負責輸出入控制 (I/O) 的系統呼叫 (System Call) 實作中採用了這種思路，系統核心常常會需要讀取使用者端的「特定資料」數次，因而產生一個大問題。由於近代的系統核心都是採用多執行緒 (Multi-Thread) 設計，在這數次的讀取之間，這些「特定資料」若是被某個可疑的執行緒修改，其結果將造成了前後資料的不一致，最終使得系統呼叫的結果出錯。另外，這些「特定資料」是存在於用戶端而非系統端，代表了有心人士可以透過修改這些資料達成控制程式流程，因而造成系統敏感資料外洩、觸發緩衝區溢位攻擊甚至取得系統控制權。 本篇論文提出了 DFGUARD 這套系統，利用 Linux 系統核心 (Kernel) 用於記憶體定址 (Memory Addressing) 的數種元件直接對記憶體進行權限操作，因而阻斷了這些可疑的寫入行為，達到阻止 Double-Fetch 的發生可能性。 ;When learning Multi-Thread Programming, it is necessary for developers to notice whether there are competing resources between each other, aka a race condition.
Double-Fetch is a special condition of race condition. As its name suggests, Double-Fetch means fetching a resource for two times. The purpose of first fetch usually checks for the legality of the resource, and then the second fetch is the usage. This is a common idea for software development.
In Linux, many of the system call implementations responsible for I/O control use this idea. The system call makes the OS kernel frequently reading the “SPECIFIC DATA” at user space for several times, which causes a big problem. Due to the multithreading design, the value of “SPECIFIC DATA” might be modified by a malicious thread between the several readings. This makes the system call to get the inconsistent value between two reads, and causes an unexpected result. In addition, these “SPECIFIC DATA” exist on user space, which means an attacker can control the process flow by changing these values. Thus, the attacker may get the sensitive data from system, launch a buffer overflow attack or even inject the shell code to get the control of whole system.
This paper presents DFGUARD, a system that uses the components for memory addressing in the Linux Kernel to perform operations of read/write permission. With this technique, DFGUARD can directly block these suspicious writing behaviors, thereby preventing the possibility of Double-Fetch vulnerability.
