Protect the System Call, Protect (Most of) the World with BASTION

System calls are a critical building block in many serious security attacks, such as control-flow hijacking and privilege escalation attacks. Security-sensitive system calls (e.g., execve, mprotect), especially play a major role in completing attacks. Yet, few defense efforts focus to ensure their legitimate usage, allowing attackers to maliciously leverage system calls in attacks. In this paper, we propose a novel System Call Integrity, which enforces the correct use of system calls throughout runtime. We propose three new contexts enforcing (1) which system call is called and how it is invoked (Call Type), (2) how a system call is reached (Control Flow), and (3) that arguments are not corrupted (Argument Integrity). Our defense mechanism thwarts attacks by breaking the critical building block in their attack chains. We implement BASTION, as a compiler and runtime monitor system, to demonstrate the efficacy of the three system call contexts. Our security case study shows that BASTION can effectively stop all the attacks including real-world exploits and recent advanced attack strategies. Deploying BASTION on three popular system call-intensive programs, NGINX, SQLite, and vsFTPd, we show BASTION is secure and practical, demonstrating overhead of 0.60%, 2.01%, and 1.65%, respectively.

系统调用是许多严重安全攻击（例如控制流劫持和权限提升攻击）中的关键构建块。对安全敏感的系统调用（例如execve、mprotect）尤其在完成攻击中起主要作用。然而，很少有防御措施专注于确保其合法使用，这使得攻击者能够在攻击中恶意利用系统调用。在本文中，我们提出了一种新颖的系统调用完整性机制，它在整个运行时强制正确使用系统调用。我们提出了三个新的上下文：（1）调用哪个系统调用以及如何调用它（调用类型），（2）如何到达系统调用（控制流），以及（3）参数未被破坏（参数完整性）。我们的防御机制通过打破攻击链中的关键构建块来阻止攻击。我们实现了BASTION，作为一个编译器和运行时监控系统，以展示这三个系统调用上下文的功效。我们的安全案例研究表明，BASTION可以有效地阻止所有攻击，包括现实世界中的漏洞利用和近期的高级攻击策略。在三个流行的系统调用密集型程序（NGINX、SQLite和vsFTPd）上部署BASTION，我们表明BASTION是安全且实用的，其开销分别为0.60%、2.01%和1.65%。