PtmxGuard: An Improved Method for Android Kernel to Prevent Privilege Escalation Attack

¹ National Secrecy Science and Technology Evaluation Center, Beijing, China
² School of Economics and Management, Beijing Jiaotong University, Beijing, China
³ Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
⁴ School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China

^* Email: liying@iie.ac.cn

Abstract

Vulnerabilities in Android kernel give opportunity for attacker to damage the system. Privilege escalation is one of the most dangerous attacks, as it helps attacker to gain root privilege by exploiting kernel vulnerabilities. Mitigation technologies, static detection methods and dynamic defense methods have been suggested to prevent privilege escalation attack, but they still have some disadvantages. In this paper, we propose an improved method named PtmxGuard to enhance Android kernel and defeat privilege escalation attack. We focus on a typical attack pattern that attacker hijacks the control flow of Android kernel to modify process credentials by corrupting critical global function pointers. PtmxGuard enforces Code Pointer Integrity to Android kernel, checks the accuracy and reliability of those pointers when they’re triggered by related system calls, and intercepts the system calls when attack activities are detected. Experiment result demonstrates that PtmxGuard can defense privilege escalation attack effectively.