RAM security

RAM security

[Jonathan Tripathy]

[-- Attachment #1.1: Type: text/plain, Size: 259 bytes --]

Hi Everyone,

In Xen, is a DomU able to access data in RAM which a previous DomU has stored in the past, but didn't "zero" it?

I understand that this is a problem with physical disks (using phy:/), just wondering if the same stands with RAM

Thanks


[-- Attachment #1.2: Type: text/html, Size: 600 bytes --]

[-- Attachment #2: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: RAM security

[George Dunlap]

I looked into this sometime this last year.  I believe the answer is
"no": the domain destruction routines will zero memory before handing
it back to Xen.

One potential data leak, however (last time I looked at this), is that
Xen does not scrub memory handed back by the balloon driver.  So if
the guest OS hasn't scrubbed it, and it contains sensitive
information, it may end up being assigned to another domain as-is
(either via ballooning or start-of-day domain creation).  At the
moment that's considered the guest's responsibility.

 -George

On Mon, Dec 6, 2010 at 2:35 PM, Jonathan Tripathy <jonnyt@abpni.co.uk> wrote:
> Hi Everyone,
>
> In Xen, is a DomU able to access data in RAM which a previous DomU has
> stored in the past, but didn't "zero" it?
>
> I understand that this is a problem with physical disks (using phy:/), just
> wondering if the same stands with RAM
>
> Thanks
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel
>
>

Re: RAM security

[Jonathan Tripathy]

Would one way around this be to disable ballooning in the DomUs?

At the minute, only my Dom0 can be ballooned, all DomU have a fixed 
memory size. Is this sufficient?

Thanks


On 06/12/10 14:49, George Dunlap wrote:
> I looked into this sometime this last year.  I believe the answer is
> "no": the domain destruction routines will zero memory before handing
> it back to Xen.
>
> One potential data leak, however (last time I looked at this), is that
> Xen does not scrub memory handed back by the balloon driver.  So if
> the guest OS hasn't scrubbed it, and it contains sensitive
> information, it may end up being assigned to another domain as-is
> (either via ballooning or start-of-day domain creation).  At the
> moment that's considered the guest's responsibility.
>
>   -George
>
> On Mon, Dec 6, 2010 at 2:35 PM, Jonathan Tripathy<jonnyt@abpni.co.uk>  wrote:
>> Hi Everyone,
>>
>> In Xen, is a DomU able to access data in RAM which a previous DomU has
>> stored in the past, but didn't "zero" it?
>>
>> I understand that this is a problem with physical disks (using phy:/), just
>> wondering if the same stands with RAM
>>
>> Thanks
>>
>> _______________________________________________
>> Xen-devel mailing list
>> Xen-devel@lists.xensource.com
>> http://lists.xensource.com/xen-devel
>>
>>

Re: RAM security

[Jonathan Tripathy]

Just a few questions:

1) By saying "the guest's responsibility", does this mean that 
CONFIG_XEN_SCRUB_PAGES=y is set in the DomU kernel config?

2) Also, if a DomU was shutdown by xm destroy, obviously the DomU 
wouldn’t scrub the RAM. However would Xen still scrub the RAM?

3) If the physical server was shutdown (e.g. plug pulled), I'm guessing 
this will presetn a problem?

4) Why doesn't Xen scrub the RAM before giving it to the DomU?

Thanks

On 06/12/10 14:49, George Dunlap wrote:
> I looked into this sometime this last year.  I believe the answer is
> "no": the domain destruction routines will zero memory before handing
> it back to Xen.
>
> One potential data leak, however (last time I looked at this), is that
> Xen does not scrub memory handed back by the balloon driver.  So if
> the guest OS hasn't scrubbed it, and it contains sensitive
> information, it may end up being assigned to another domain as-is
> (either via ballooning or start-of-day domain creation).  At the
> moment that's considered the guest's responsibility.
>
>   -George
>
> On Mon, Dec 6, 2010 at 2:35 PM, Jonathan Tripathy<jonnyt@abpni.co.uk>  wrote:
>> Hi Everyone,
>>
>> In Xen, is a DomU able to access data in RAM which a previous DomU has
>> stored in the past, but didn't "zero" it?
>>
>> I understand that this is a problem with physical disks (using phy:/), just
>> wondering if the same stands with RAM
>>
>> Thanks
>>
>> _______________________________________________
>> Xen-devel mailing list
>> Xen-devel@lists.xensource.com
>> http://lists.xensource.com/xen-devel
>>
>>

Re: RAM security

[Keir Fraser]

On 06/12/2010 07:35, "Jonathan Tripathy" <jonnyt@abpni.co.uk> wrote:

> Just a few questions:
> 
> 1) By saying "the guest's responsibility", does this mean that
> CONFIG_XEN_SCRUB_PAGES=y is set in the DomU kernel config?

Yes.

> 2) Also, if a DomU was shutdown by xm destroy, obviously the DomU
> wouldn¹t scrub the RAM. However would Xen still scrub the RAM?

Xen always scrubs memory on behalf of a dead domain.

> 3) If the physical server was shutdown (e.g. plug pulled), I'm guessing
> this will presetn a problem?

Xen scrubs all memory during boot, unless told not to via a boot parameter.

> 4) Why doesn't Xen scrub the RAM before giving it to the DomU?

It does in the above circumstances. Otherwise it is up to the domU, and why
not.

 -- Keir

> Thanks
> 
> On 06/12/10 14:49, George Dunlap wrote:
>> I looked into this sometime this last year.  I believe the answer is
>> "no": the domain destruction routines will zero memory before handing
>> it back to Xen.
>> 
>> One potential data leak, however (last time I looked at this), is that
>> Xen does not scrub memory handed back by the balloon driver.  So if
>> the guest OS hasn't scrubbed it, and it contains sensitive
>> information, it may end up being assigned to another domain as-is
>> (either via ballooning or start-of-day domain creation).  At the
>> moment that's considered the guest's responsibility.
>> 
>>   -George
>> 
>> On Mon, Dec 6, 2010 at 2:35 PM, Jonathan Tripathy<jonnyt@abpni.co.uk>  wrote:
>>> Hi Everyone,
>>> 
>>> In Xen, is a DomU able to access data in RAM which a previous DomU has
>>> stored in the past, but didn't "zero" it?
>>> 
>>> I understand that this is a problem with physical disks (using phy:/), just
>>> wondering if the same stands with RAM
>>> 
>>> Thanks
>>> 
>>> _______________________________________________
>>> Xen-devel mailing list
>>> Xen-devel@lists.xensource.com
>>> http://lists.xensource.com/xen-devel
>>> 
>>> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel

Re: RAM security

[Jonathan Tripathy]

> Xen always scrubs memory on behalf of a dead domain.
>
>> 3) If the physical server was shutdown (e.g. plug pulled), I'm guessing
>> this will presetn a problem?
> Xen scrubs all memory during boot, unless told not to via a boot parameter.
>
Now this bit of code makes me happy!

Just wondering, if Xen scrubs all memory during boot, why is booting the 
Hypervisor so fast? My machine has 8GB of RAM and starts nice and snappy..

>> 4) Why doesn't Xen scrub the RAM before giving it to the DomU?
> It does in the above circumstances. Otherwise it is up to the domU, and why
> not.
>

I think that with the on-booting and the on-destroy scrubbing, my 4) 
point above is moot :)

Cheers

Re: RAM security

[Keir Fraser]

On 06/12/2010 08:31, "Jonathan Tripathy" <jonnyt@abpni.co.uk> wrote:

>>> 3) If the physical server was shutdown (e.g. plug pulled), I'm guessing
>>> this will presetn a problem?
>> Xen scrubs all memory during boot, unless told not to via a boot parameter.
>> 
> Now this bit of code makes me happy!
> 
> Just wondering, if Xen scrubs all memory during boot, why is booting the
> Hypervisor so fast? My machine has 8GB of RAM and starts nice and snappy..

It probably takes just a couple of seconds to scrub 8GB. Xen does the
scrubbing immediately before starting dom0, and you should see it say
'Scrubbing RAM...' and extra dots continur to appear until scrubbing is
complete.

 -- Keir

Re: RAM security

[Jonathan Tripathy]

On 06/12/10 16:52, Keir Fraser wrote:
> On 06/12/2010 08:31, "Jonathan Tripathy"<jonnyt@abpni.co.uk>  wrote:
>
>>>> 3) If the physical server was shutdown (e.g. plug pulled), I'm guessing
>>>> this will presetn a problem?
>>> Xen scrubs all memory during boot, unless told not to via a boot parameter.
>>>
>> Now this bit of code makes me happy!
>>
>> Just wondering, if Xen scrubs all memory during boot, why is booting the
>> Hypervisor so fast? My machine has 8GB of RAM and starts nice and snappy..
> It probably takes just a couple of seconds to scrub 8GB. Xen does the
> scrubbing immediately before starting dom0, and you should see it say
> 'Scrubbing RAM...' and extra dots continur to appear until scrubbing is
> complete.
>
>   -- Keir
>
I guess in my head I'm comparing RAM scrubbing to dd if=/dev/zero, which 
takes longer as it's usually to disk

Re: RAM security

[Jan Beulich]

>>> On 06.12.10 at 17:52, Keir Fraser <keir@xen.org> wrote:
> On 06/12/2010 08:31, "Jonathan Tripathy" <jonnyt@abpni.co.uk> wrote:
> 
>>>> 3) If the physical server was shutdown (e.g. plug pulled), I'm guessing
>>>> this will presetn a problem?
>>> Xen scrubs all memory during boot, unless told not to via a boot parameter.
>>> 
>> Now this bit of code makes me happy!
>> 
>> Just wondering, if Xen scrubs all memory during boot, why is booting the
>> Hypervisor so fast? My machine has 8GB of RAM and starts nice and snappy..
> 
> It probably takes just a couple of seconds to scrub 8GB. Xen does the

Plus it doesn't scrub the memory assigned to Dom0.

> scrubbing immediately before starting dom0, and you should see it say
> 'Scrubbing RAM...' and extra dots continur to appear until scrubbing is
> complete.

Jan

Re: RAM security

[Jonathan Tripathy]

3) If the physical server was shutdown (e.g. plug pulled), I'm guessing
>>>>> this will presetn a problem?
>>>> Xen scrubs all memory during boot, unless told not to via a boot parameter.
>>>>
>>> Now this bit of code makes me happy!
>>>
>>> Just wondering, if Xen scrubs all memory during boot, why is booting the
>>> Hypervisor so fast? My machine has 8GB of RAM and starts nice and snappy..
>> It probably takes just a couple of seconds to scrub 8GB.
> Plus it doesn't scrub the memory assigned to Dom0.
>
Doesn't this mean that if Dom0 releases some memory back to Xen, then 
Xen gives it to another domain, data leakage could occur?

Would one way to prevent this be to disable ballooning?

Thanks

Re: RAM security

[Jonathan Tripathy]

On 06/12/10 17:12, Jonathan Tripathy wrote:
> 3) If the physical server was shutdown (e.g. plug pulled), I'm guessing
>>>>>> this will presetn a problem?
>>>>> Xen scrubs all memory during boot, unless told not to via a boot 
>>>>> parameter.
>>>>>
>>>> Now this bit of code makes me happy!
>>>>
>>>> Just wondering, if Xen scrubs all memory during boot, why is 
>>>> booting the
>>>> Hypervisor so fast? My machine has 8GB of RAM and starts nice and 
>>>> snappy..
>>> It probably takes just a couple of seconds to scrub 8GB.
>> Plus it doesn't scrub the memory assigned to Dom0.
>>
> Doesn't this mean that if Dom0 releases some memory back to Xen, then 
> Xen gives it to another domain, data leakage could occur?
>
> Would one way to prevent this be to disable ballooning?
Silly me, Dom0 should scrub the RAM before releasing it back to Xen, as 
mentioned in previous post!