kdMonitor: Kernel Data Monitor for Detecting Kernel Memory Corruption

Privilege escalation attacks through memory corruption via kernel vulnerabilities pose significant threats to operating systems. Although the extended Berkley Packet Filter has been employed to trace kernel code execution by inserting interrupts before and after kernel code invocations, it does not track operations before and after kernel data writes, thus hindering effective kernel data monitoring. In this study, we introduce a kernel data monitor (kdMonitor), which is a novel security mechanism designed to detect unauthorized alterations in the monitored kernel data of a dedicated kernel page. The kdMonitor incorporates two distinct methods. The first is periodic monitoring which regularly outputs the monitored kernel data of the dedicated kernel pages. The second is dynamic monitoring, which restricts write access to a dedicated kernel page, supplements any write operations with page faults, and outputs the monitored kernel data of dedicated kernel pages. kdMonitor enables real-time tracking of specified kernel data of the dedicated kernel page residing in the kernel's virtual memory space from the separated machine. Using kdMonitor, we demonstrated its capability to pinpoint tampering with user process privileged information stemming from privilege escalation attacks on the kernel. Through an empirical evaluation, we validated the effectiveness of kdMonitor in detecting privilege escalation attacks by user processes on Linux. Performance assessments revealed that kdMonitor achieved an attack detection time of 0.83 seconds with an overhead of 0.726 %.