# H-KPP: Hypervisor-Assisted Kernel Patch Protection
## 1 Introduction  
The execution of an unauthorized code is one of the attackers' main vehicles in their malicious actions. Multiple solutions have been proposed to prevent these attacks at various stages, for example, Data Execution Prevention (DEP) [1] and driver signing [2] attempt to prevent the execution and introduction of unauthorized code. Unfortunately, both solutions were circumvented [3, 4].  
In addition to executing new code in kernel mode, attackers may attempt to perform direct kernel-object modification (DKOM) to achieve their goal by overwriting various fields of kernel objects directly. DKOM attacks can be used for privilege escalation and hiding the attack traces. Microsoft's Kernel Patch Protection (KPP) is an obfuscated integrity checking mechanism for the Windows kernel. As with the previously described security measures, KPP was reverse-engineered, and disabled [5]. In addition, KPP is not available for the Linux kernel, which also suffers from vulnerabilities [6]. In particular, 158 new vulnerabilities were discovered in 2021 alone [7].  
We introduce H-KPP, hypervisor-based protection for Linux kernel code and data structures. H-KPP prevents the execution of unauthorized code in kernel mode. In addition, H-KPP protects certain object fields from malicious modifications. H-KPP can protect modern kernels equipped with BPF facilities and loadable kernel modules. H-KPP does not require modifying or recompiling the kernel. Unlike many other systems, H-KPP is based on a thin hypervisor and includes a novel SLAT switching mechanism, which allows H-KPP to achieve very low (\(\approx\)6%) performance overhead compared to baseline Linux.  
H-KPP accomplishes its main goal using two secondary-level address translation (SLAT) hierarchies: the kernel and user mode hierarchies. The hypervisor switches between the two hierarchies on every mode transition. The kernel-mode hierarchy prevents the execution of all the pages but the pages belonging to the verified kernel and modules. The transition between the hierarchies does not require the hypervisor's attention, thus keeping the overall system performance at optimum. H-KPP, unlike similar systems, supports modern kernel features, like just-in-time code generation, which is used by the BPF.  
H-KPP's detection of DKOM is based on periodic verifications of various object fields. This behavior is similar to Microsoft's KPP. However, the functionality of H-KPP in this regard is much broader and is comparable with the functionality of Volatility, an offline forensic investigation tool [8].  
We have verified the effectiveness of H-KPP by using a specially crafted kernel module that mimics some aspects of the malicious behavior of various attacks. It may seem more natural to run an actual attack; unfortunately, the attacks we have found target older versions of the Linux kernel. H-KPP successfully detected all the attacks that were performed by the kernel module.  
We have measured the performance of H-KPP code protection using various benchmarks, which showed an average overhead of only \(\approx\)6%. We note that the overhead of full hypervisors, which form the basis for other solutions, is much more significant. In addition, we have evaluated the performance of the periodic kernel object verification. Our main contributions are:  
* We present the design of H-KPP, a KPP-like system implemented as a thin hypervisor.
* We present a novel SLAT-switching technique used by H-KPP, which can be helpful in other scenarios.
* We present an online approach for kernel object verification that does not require recompilation of the kernel.
* We evaluate the effectiveness of H-KPP using a kernel module that mimics common attacks.
* We evaluate the performance of H-KPP.