Guest protection from application code execution in kernel mode
AssigneeRed Hat Israel, Ltd.
InventorsMichael Tsirkin, Paolo Bonzini
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed for securing an application running on a guest. An example method includes detecting, by a guest running on a virtual machine, that a set of physical memory pages is allocated to an application. The virtual machine runs on a hypervisor, and the application runs on the guest. During runtime, the guest may send a request to the hypervisor to set the set of physical memory pages to an executable-by-user mode in the hypervisor's page tables.
Claims20
A method of securing an application running on a guest, comprising:
- detecting, by a guest running on a virtual machine, that a set of physical memory pages is allocated to an application, the virtual machine running on a hypervisor, and the application running on the guest;
- and
- sending, by the guest, a request to the hypervisor to set the set of physical memory pages to an executable-by-user mode in the hypervisor's page tables.
A system for securing an application running on a guest, comprising:
- a guest that runs on a virtual machine and detects that an application is loaded, wherein the virtual machine runs on a hypervisor;
- an application code protector that detects that a set of physical memory pages is allocated to the application;
- and
- an I/O module that sends a request to the hypervisor to set the set of physical memory pages to an executable-by-user mode in the hypervisor's page tables.
A machine-readable medium comprising a plurality of machine-readable instructions that when executed by one or more processors is adapted to cause the one or more processors to perform a method comprising:
- detecting, by a guest running on a virtual machine, that a set of physical memory pages is allocated to an application, the virtual machine running on a hypervisor, and the application running on the guest;
- and
- sending, by the guest, a request to the hypervisor to set the set of physical memory pages to an executable-by-user mode in the hypervisor's page tables.
Dependencies are inferred from the claim text.