Opensource Kernel Auditing and Exploitation

Architecture and Background

Silvio Cesare - Opensource Kernel Auditing and Exploitation Opensource Kernel Auditing and Exploitation For a period of up to 3 months in 2002, a part-time manual security audit of the operating system kernels in Linux, FreeBSD, OpenBSD, and NetBSD was conducted. The aims of audit were to examine the available source code, under the presumption of language implementation bugs. Thus classic programming bugs, prevalent in the implementation language [C], exemplified in integer overflows, type casting, incorrect input validation and buffer overflows etc were expected. The initial introduction to auditing examined easily accessible entry points into the kernel including the file system and the device layer. This continued to an increased coverage and scope of auditing. From this work, identification of conjectured prevalent bug classes was possible. These results are in favour of the initial expectations; that bugs would be that in line of classical language bugs.

Vulnerability Analysis

The results of this audit are surprising; a large [more than naively expected] number of vulnerabilities were discovered. A technical summary of these vulnerabilities will be treated in detail. Bug classes and [conjectured] less secure specific subsystems in the kernel will be identified. These conjectures support the the research of Dawson Engler's work in automated bug discovery in application to open-source kernel auditing. Vulnerabilities after bug categorisation, are applied in the treatment of exploitation. The results are again surprising; exploitation sometimes being trivial, and primarily being highly reliable. The assumptions of exploitation difficulty, is conjectured to be a false belief due to lack of any serious focus on kernel auditing prior to this paper.

Exploitation and Demonstrations

This conjecture is supported by in-line documentation of kernel sources indicative of immediate security flaws. Attack vectors are identified as a generalisation of bug classes. Risk management is touched upon to reduce the scope of attack, but is not the primary purpose of this paper. Discussion is finally that of vendor contact, and the associated politics of vulnerabilities. First hand reports of acknowledgement times, problem resolution times and public dissemination policies are presented in candid. The author may be biased at this point, but it appears that in during this audit period, open-source holds up to the promise of security concern and responsibility in its community. Problem acknowledgement in at least one of the the cases presented is perhaps the fastest in documented history (less than three minutes).

Remediation and Defensive Strategies

The majority of the vulnerabilities discovered during the audit, were resolved and patched in co-operation with the open-source developers and community responsible for each respective operating system. A very large thanks must go to Alan Cox, Solar Designer and later followed by Dave Miller who made enormous efforts to continually resolve all issues uncovered. Silvio Cesare has for many years, been involved in computer security and the many talented and lesser front page individuals behind it. In 2001, Silvio relocated from Australia to France to work in the development of managed vulnerability assessment, after the best part of the previous year in Australia establishing the legal requirements to make this possible. In 2002, he relocated again to the US, after cessation of product development in France. During the last months working in the US as scanner architect of the companies flagship MVA product, he spent his part time auditing open source operating system kernels. Silvio spoke at conferences in 2002, including CanSecWest on his reverse engineering work; for which he was at one time in negotiations for authoring a book on Unix Virus. After impending legal requirements to leave the US, Silvio returned back to Australia for 2003. During the current year, he has been quietly involved in Ruxcon, an Australian computer security conference, presenting the results of the previous years part-time auditing. Silvio spends his days currently in Australia as a System Administrator outside of industry interests in computer security.