| dc.description.abstract | When learning Multi-Thread Programming, it is necessary for developers to notice whether there are competing resources between each other, aka a race condition.
Double-Fetch is a special condition of race condition. As its name suggests, Double-Fetch means fetching a resource for two times. The purpose of first fetch usually checks for the legality of the resource, and then the second fetch is the usage. This is a common idea for software development.
In Linux, many of the system call implementations responsible for I/O control use this idea. The system call makes the OS kernel frequently reading the “SPECIFIC DATA” at user space for several times, which causes a big problem. Due to the multithreading design, the value of “SPECIFIC DATA” might be modified by a malicious thread between the several readings. This makes the system call to get the inconsistent value between two reads, and causes an unexpected result. In addition, these “SPECIFIC DATA” exist on user space, which means an attacker can control the process flow by changing these values. Thus, the attacker may get the sensitive data from system, launch a buffer overflow attack or even inject the shell code to get the control of whole system.
This paper presents DFGUARD, a system that uses the components for memory addressing in the Linux Kernel to perform operations of read/write permission. With this technique, DFGUARD can directly block these suspicious writing behaviors, thereby preventing the possibility of Double-Fetch vulnerability. | en_US |