System and method for kernel rootkit protection in a hypervisor environment

An apparatus, comprising:

• a memory;
• and
• a processor configured to create a soft whitelist having an entry corresponding to a guest kernel page of a guest OS in a hypervisor environment comprising a hypervisor, wherein the entry is a duplicate page of the guest kernel page,
• the processor is further configured to map a virtual base address of the guest kernel page to a machine page frame number of the corresponding duplicate page, the guest OS has not loaded at least some kernel components, and
• the processor is further configured to generate a page fault when a process attempts to access the guest kernel page, and to redirect the process to the duplicate page corresponding to the guest kernel page if the page fault is an instruction page fault.

Logic encoded in non-transitory media that includes code for execution and, when executed by a processor, is operable to perform operations comprising:

• creating a soft whitelist having an entry corresponding to a guest kernel page of a guest OS in a hypervisor environment comprising a hypervisor, wherein the entry is a duplicate page of the guest kernel page;
• mapping a virtual base address of the guest kernel page to a machine page frame number of the corresponding duplicate page, wherein the guest OS has not loaded at least some kernel components;
• generating a page fault when a process attempts to access the guest kernel page;
• and
• redirecting the process to the duplicate page corresponding to the guest kernel page if the page fault is an instruction page fault.

A method, comprising:

• creating a soft whitelist having an entry corresponding to a guest kernel page of a guest operating system (OS) in a hypervisor environment comprising a hypervisor, wherein the entry is a duplicate page of the guest kernel page, and the creating the soft whitelist is performed after the guest OS has loaded kernel components at boot;
• walking a shadow page table of the hypervisor;
• mapping a virtual address of the guest kernel page to a machine page frame number of the corresponding duplicate page;
• generating a page fault when a process attempts to access the guest kernel page;
• and
• redirecting the process to the duplicate page corresponding to the guest kernel page if the page fault is an instruction page fault.

Logic encoded in non-transitory media that includes code for execution and, when executed by a processor, is operable to perform operations comprising:

• creating a soft whitelist having an entry corresponding to a guest kernel page of a guest OS in a hypervisor environment comprising a hypervisor, wherein the entry is a duplicate page of the guest kernel page, and the creating soft whitelist is performed after the guest OS has loaded a plurality of kernel components at boot;
• walking a shadow page table of the hypervisor;
• mapping a virtual address of the guest kernel page to a machine page frame number of the corresponding duplicate page;
• generating a page fault when a process attempts to access the guest kernel page;
• and
• redirecting the process to the duplicate page corresponding to the guest kernel page if the page fault is an instruction page fault.