In ARM there are certain instructions that generates exception. Such instructions are typically executed to request a service from software that runs at a higher privilege level. From the OS kernel (EL1), software can call the Hypervisor (EL2) with the HVC instruction. The KVM Hypervisor is part of the Linux kernel and by default it is enabled on all supported ARM system. In ARM architecture KVM is implemented through split-mode virtualization and runs across different privileged CPU modes. This talk will discuss about the design and a security issue in a way Linux kernel initializes the KVM Hypervisor. An attacker having access to host EL1 can execute code in EL2. This security issue can be exploited by an attacker to install a Hypervisor root kit on ARM system.

1. Back To The Future: A Radical
Insecure Design of KVM on ARM
Baibhav Singh
Rahul Kashyap
B. Sing - SRA 1

2. • Samsung Research America
• Actively working on ARM system security
*The opinion present are my own and not necessarily
represent the opinion of my employer
Introduction B. Sing - SRA
2

3. • Found this issue while doing some hypervisors research
• On 25 Jan 2018, reported to Red Hat Product Security team
Secalert@redhat.com provided detail report with exploit code
• Multiple mail exchange to help them understand the problem
• Still is not fixed
• Decided to submit a BH paper (Thanks to Rahul, Michael Grace)
• Thanks to BH for providing the platform
Background B. Singh - SRA
3

4. ARM v8-A Architecture
HVC HVC
HVC Handler
B. Singh - SRA
4

5. Exception Vector TableB. Sing - SRA
5
VBAR_EL2HVC
0x400
+

6. ARM Hypervisor executes in EL2
TYPE 1
• Bare Metal Hypervisor
• Host is considered as VM
• XEN is type 1 and runs in EL2
TYPE 2
• Hypervisor is extension of Host Kernel
• Host is not considered as VM
• KVM is type 2 and runs partial in EL2
ARM - Hypervisor B. Singh - SRA
6

7. Linux Start
EL==2
1. Updates
VBAR_EL2 to
Install STUB
Vector Table as
EL2 Exception
Vector Table
2. Switches back to
EL1 Normal Boot
Flow
YES
No
Linux and KVM B. Singh - SRA
7

8. Handler in case HVC originating
from 64 bit Kernel
VBAR_EL2
Stub Vector Table
Filename : linuxarcharm64kernelhyp-
stub.s
B. Sing - SRA
8

9. Checks if register X0 == 0
Updates VBAR_EL2
Stub HVC Handler
Filename : linuxarcharm64kernelhyp-stub.s
B. Singh - SRA
9

10. B. Singh - SRA
10
Linux Start STUB VECTOR
TABLE
CMD ==
HVC_SET_VECTO
R
KVM VECTOR
TABLE
VBAR_EL2
State Diagram 1

11. Filename : linuxarcharm64kernelhyp-entry.s
Checks if HVC is from Host
Checks if register x0 < 3
Calls _kvm_handle_stub_hvc
KVM HVC Handler B. Singh - SRA
11

12. Checks register X0 == 2
Disables EL2 MMU
Back to Stub Vector
Filename :
linuxarcharm64kvmhyphyp-entry.s
KVM HVC Handler B. Singh - SRA
12

13. B. Singh - SRA
13
Linux Start STUB VECTOR
TABLE
CMD ==
HVC_SET_VECTO
R
KVM VECTOR
TABLE
HVC == HOST
&& CMD ==
HVC_RESET_VEC
TOR
VBAR_EL2
Attackers Vector
Table
State Diagram 2

14. X0 =2 ; //HVC_RESET_VECTORS
KVM Vector TableStub Vector Table
1. Allocate physical continuous
memory
2. Embed shellcode at an offset
0x400 (Exception handler)
3. Set X0 = 0 //HVC_SET_VECTOR
4. Set X1 = physical address of
buffer
Attacker
Allocated Buffer
Disables
MMU
Installs
Installs
HVC
HVC
HVC EL2 Shellcode
Host EL1 EL2
Exploitation B. Singh - SRA
14

15. KVM Team Response
“You're on the host, and you can break KVMby inserting a rogue kernel module. Big deal. You can
also blast the page tables, corrupt file systems, and make sure the box is on fire”
KVM Threat Model Assumption : HOST.EL1 == EL2
Security hole in privilege isolation boundary
Host kernel compromise is End of the Game !
Real World : EL1 != EL2
For Attacker Beginning of a New Game.… J
Attacker can exploit this issue to gain more privilege and will migrate to EL2
• Launch attack from isolated and unreachable memory.
• Can configure EL2 to get code execution from various different places
• A generic way to bypass security implemented in the kernel (LKRG),by escaping to EL2
• Attack the secure monitoring running in hypervisor mode
• Gives attacker opportunity for Blue Pill for KVM on ARM
Juicy target for attacker to perform highly sophisticated and stealthy attack
B. Singh - SRA
15

16. Potentially bigger impact for mobile and IoT
•Most of them are ARM based
•Chances are high that it will boot in EL2
•Single Kernel Device (More Attack Surface)
Affected Architecture: ARM v7-A and ARM v8-A with hardware virtualization
Impact B. Singh - SRA
16

17. Mitigation
My two cents… You’re likely vulnerable to this attack.
Patch the system by making sure Linux starts in EL1
B. Singh - SRA
17

18. • https://static.docs.arm.com/ddi0487/ca/DDI0487C_a_armv8_arm.pd
f
• https://developer.arm.com/products/architecture/a-
profile/docs/100942/latest/hypervisor-software
• https://dl.acm.org/citation.cfm?id=2541946
• http://www.cs.columbia.edu/~cdall/pubs/atc17-dall.pdf
• http://www.cs.columbia.edu/~cdall/pubs/sosp2017-neve.pdf
• https://lwn.net/Articles/557132/
• http://lia.disi.unibo.it/Courses/som1516/materiale/VOSYS_BolognaK
VMARM_2_12_2015.pdf
Reference B. Singh - SRA
18