PTStore: Lightweight Architectural Support for Page Table Isolation

Page tables are critical data structures in kernels, serving as the trust base of most mitigation solutions. Their integrity is thus crucial but is often taken for granted. Existing page table protection solutions usually provide insufficient security guarantees, require heavy hardware, or introduce high overheads. In this paper, we present a novel lightweight hardware-software co-design solution, PTStore, consisting of a secure region storing page tables and tokens verifying page table pointers. Evaluation results on FPGA-based prototypes show that PTStore only introduces <0.92% hardware overheads and <0.86% performance overheads, but provides strong security guarantees, showing that PTStore is efficient and effective.

• We propose a novel lightweight hardware-software co-design solution PTStore, consisting of a secure region and a novel token mechanism, to protect page tables.

• We build an FPGA-based prototype of PTStore on RISC-V.

• We conduct a thorough performance and security evaluation, showing that PTStore is lightweight, practical, and efficient, as well as effective against various page table attacks.

RISC-V and many other ISAs provide PMP support, which enables M-mode code to configure permissions of physical memory regions for S-mode code and data [17]. For example, M-mode code can mask some physical memory ranges so that kernels in S-mode are not permitted to access them.

Page tables are critical data structures in kernels as they store address mappings and access permissions of VM pages. A system can get compromised if even only one bit of its page tables gets flipped [18]. However, page tables are vulnerable to both hardware [18] and software [4] vulnerabilities. Once memory-corruption vulnerabilities exist, attackers can utilize the following techniques to compromise the system (including kernels and even deployed mitigations), which is similar to code corruption, injection, and reuse attacks.