Divide et Impera: MemoryRanger Runs Drivers in Isolated Kernel Spaces

on YouTube ↗51m

" summary

MemoryRanger claims to stop driver code-dumps, data theft and PROCESS privilege escalation by running each third-party driver in per-driver EPT enclaves implemented on Intel VT-x / EPT; illegal reads/writes trigger EPT violations, the hypervisor swaps PFNs to redirect PFN to fake pages and returns fake data while restoring the real page afterward. Prototype isolates three test drivers, prevents dumping and data tampering, blocks an attempted privilege escalation, runs ~3× faster than a closest EPT-only competitor, but is a proof‑of‑concept that doesn’t yet handle preloaded drivers or coexisting Hyper‑V.

AI-written summary · about

" chapters (12)

1. 0:00Introduction
2. 1:27The threat of kernel attacks
3. 3:24Demonstration of memory theft
4. 7:32Privilege escalation demo
5. 10:53Existing security limitations
6. 12:20Virtualization and EPT
7. 15:14Memory Ranger design
8. 19:16Memory Ranger demo
9. 28:17Architecture summary
10. 31:19Implementation steps
11. 33:53Benchmarks and conclusion
12. 36:24Q&A and final demo

" related talks

• 01h 03mret2dir: Deconstructing Kernel IsolationVasileios P. Kemerlis · Black Hat Europe 2014
• 53mXenpwn: Breaking Paravirtualized DevicesFelix Wilhelm · Black Hat USA 2016
• 18mGuest Memory Protection -- Current Status and FutureIsaku Yamahata · KVM Forum 2020
• 24mShielding Software From Privileged Side-Channel AttacksXiaowan Dong · USENIX Security '18
• 30mMicro-Virtualization Memory Tracing to Detect and Prevent Spraying AttacksStefano Cristalli, Mattia Pagnozzi, Mariano Graziano, Andrea Lanzi, Davide Balzarotti · USENIX Security '16
• 25mHigh Performance VM IntrospectionCristinel-Ionel Anichitei, Raul Tosa · BSidesSF 2019
• 48mNext Level Cheating and Leveling Up MitigationsJoel St. John, Nicolas Guigo · Black Hat Asia 2015
• 32mSeeing Through The Same Lens...Siqi Zhao, Wen Xu, Dawu Gu, Xuhua Ding · 26th USENIX Security Symposium (USENIX Security '17)