00SEVen – Re-enabling Virtual Machine Forensics: Introspecting Confidential VMs Using Privileged in-VM Agents

00SEVen – Re-enabling Virtual Machine Forensics: Introspecting Confidential VMs Using Privileged in-VM Agents

Speakers: Fabian Schwarz, PhD Student, CISPA Helmholtz Center for Information Security; Christian Rossow, Professor, CISPA Helmholtz Center for Information Security

Conference: USENIX Security '24

YouTube: https://www.youtube.com/watch?v=fcoBt4he8-Y

Overview

Modern cloud computing environments rely heavily on virtual machines (VMs) to host diverse services and applications. A critical security capability in these environments is VM introspection (VMI), which allows hypervisors to monitor the internal state of a guest VM to detect and respond to in-VM attackers like rootkits or malware. However, the rise of Confidential Computing technologies, such as AMD Secure Encrypted Virtualization (SEV) and Intel Total Memory Encryption (TME) with extensions like AMD SEV-SNP and Intel TDX, has introduced a significant challenge. While these technologies provide robust hardware-enforced isolation, protecting VMs from even a malicious or compromised hypervisor, they concurrently render traditional VMI unfeasible due to their strong memory and register encryption and access controls.

This talk by Fabian Schwarz and Professor Christian Rossow from the CISPA Helmholtz Center for Information Security addresses this fundamental dilemma. Their project, named 00SEVen, proposes a novel approach to re-enable secure remote inspection for confidential VMs (CVMs) without compromising their inherent security guarantees. By strategically leveraging hardware features of AMD SEV-SNP, 00SEVen introduces a trusted in-VM agent operating in a highly privileged domain, capable of performing VMI operations securely and exposing them to a remote, trusted client.

The significance of 00SEVen lies in its ability to bridge a critical security gap. As organizations increasingly deploy sensitive workloads in confidential computing environments, the inability to perform forensic analysis or real-time threat detection within these CVMs presents a substantial risk. 00SEVen demonstrates that it is possible to achieve both strong host-isolation and comprehensive in-VM security monitoring, offering a practical pathway for enhancing the security posture of confidential cloud deployments.

Background

▶ Watch: Introduction: The challenge of inspecting confidential VMs (0:00)

The landscape of virtual machine security has evolved significantly. Traditionally, VM introspection (VMI) has been a cornerstone for detecting threats within guest operating systems. VMI capabilities, typically offered by the hypervisor, allow for secure monitoring of a VM's memory, registers, and execution flow. This is crucial for identifying in-VM attackers, such as kernel rootkits or advanced persistent threats (APTs), which operate within the guest OS and might evade conventional endpoint security solutions. The hypervisor, assumed to be trusted, can pause VM execution, enable memory access traps, and directly inspect the VM's state, providing an out-of-band monitoring channel.

However, this traditional model rests on a critical assumption: the cloud provider's hypervisor and underlying host platform are entirely trustworthy. In reality, cloud platforms can be susceptible to insider attackers, sophisticated external adversaries, or vulnerabilities in the host software. Such compromises could allow an attacker to abuse the hypervisor's VMI capabilities, not for benign monitoring, but to spy on, manipulate, or steal sensitive data from customer VMs. This inherent vulnerability led to the development of Confidential Computing.

Confidential Computing technologies, exemplified by AMD's Secure Encrypted Virtualization (SEV) with its Secure Nested Paging (SNP) extension, and Intel's Trusted Domain Extensions (TDX), aim to address this trust problem. These technologies introduce hardware-protected virtual machines (CVMs) where the VM's memory and CPU registers are encrypted and protected from the host software, including the hypervisor, and other VMs. This strong isolation guarantees confidentiality and integrity even if the host platform is compromised. While a major leap forward for data security in the cloud, this robust isolation comes at a cost: it renders traditional, hypervisor-based VMI unfeasible. The hypervisor can no longer access the encrypted memory or directly manipulate the CVM's execution state for monitoring purposes.

The project's goal, therefore, was to reconcile these two seemingly conflicting security requirements: the strong hardware isolation provided by CVMs and the critical need for secure, remote in-VM inspection. The threat model for 00SEVen assumes an untrusted cloud platform, which constitutes a powerful out-of-VM attacker. Additionally, it considers a second attacker inside the confidential VM (e.g., a kernel rootkit or malware) that the system aims to detect. The trusted remote client (VM owner) deploys sensitive services in the CVM and needs to perform secure remote inspection to monitor for these in-VM attackers. This challenging scenario necessitates a new approach to VMI that operates within the confines of hardware-enforced CVM isolation.

Key Findings

▶ Watch: O7 solution: Introducing the trusted in-VM agent (2:50)

The core innovation of 00SEVen lies in its ability to re-enable secure remote introspection for AMD SEV-SNP confidential VMs by introducing a trusted in-VM agent that operates in a highly privileged, hardware-isolated domain. This agent is responsible for performing the necessary VMI operations from within the CVM, circumventing the host-level restrictions imposed by confidential computing.

The key findings and contributions of the 00SEVen project are:

1. Hardware-Enforced Agent Isolation: 00SEVen leverages VM Privilege Levels (VMs), a feature of AMD SEV-SNP, to isolate its in-VM agent within the most privileged domain, VMPL0. This ensures that even in-VM attackers operating in the guest OS (e.g., in VMPL1) cannot compromise the agent or its VMI operations. The agent maintains full memory and register access to the rest of the VM while being protected itself.

1. Secure and Fast Remote Communication: A novel communication channel is established using a virtual vQ device directly attached to VMPL0, bypassing the untrusted guest OS. This channel is then bridged by a network proxy on the host, enabling the remote client to securely communicate with the agent via TLS endpoints and verify its integrity through remote attestation.

1. Novel Secure VM Pausing: Traditional VM pausing by the hypervisor is insecure in CVMs. 00SEVen introduces a new mechanism where the VMPL0 agent requests the hypervisor to interrupt and pause VMPL1 execution. Crucially, the agent then disables virtualization support for VMPL1 CPU register sets, preventing the untrusted hypervisor from resuming VMPL1 execution without hardware intervention. This guarantees that VMI operations are performed on a static, consistent state.

1. Practical Implementation and Performance: A prototype implementation for Linux KVM/QEMU and AMD SEV-SNP CVMs demonstrates the feasibility of 00SEVen. The system exhibits acceptable overhead, with remote inspection incurring approximately a 20% overhead compared to traditional VMI on regular VMs, making it a viable solution for real-world deployments.

These findings collectively demonstrate that secure, remote VMI is achievable for CVMs, restoring a critical security capability for sensitive workloads in confidential cloud environments.

Technical Deep Dive

▶ Watch: Agent isolation using hardware-enforced VM Privilege Levels (4:00)

00SEVen's architecture is meticulously designed to operate within the strict security model of AMD SEV-SNP, ensuring that the in-VM introspection agent is both protected from attackers and capable of performing its duties.

The foundation of 00SEVen's security lies in VM Privilege Levels (VMs). These are distinct in-VM CPU modes, orthogonal to the traditional user and kernel modes, introduced by AMD SEV-SNP. An in-VM CPU can operate in one VMPL at a time, and within that VMPL, switch between user and kernel modes as usual. AMD SEV-SNP currently defines four VMPLs, with VMPL0 being the most privileged, possessing full memory and register access. 00SEVen strategically isolates its trusted in-VM agent within this VMPL0 domain. The untrusted guest OS, containing potential in-VM attackers, is confined to a less privileged VMPL (typically VMPL1). This separation ensures that the agent can access all VM memory and registers for VMI operations, while remaining protected from any compromise of the guest OS.

The memory protection mechanisms of AMD SEV-SNP are crucial for understanding this isolation. In a CVM, the host-defined second-level page tables map the VM's memory to a sub-region of the host memory. When a memory access occurs inside the CVM, the virtual address is first translated by the CVM's page tables to a guest physical address (GPA), which is then translated by the host's tables to a host physical address (HPA). Two key differences distinguish CVMs from regular VMs:

1. Memory Encryption: The vast majority of CVM pages are encrypted, rendering them unreadable by the host software or other VMs.
2. Hardware-Enforced Reverse Map Table (RMT): This critical hardware component stores, for each HPA, the owning CVM and its corresponding GPA. The RMT prevents unauthorized access by the host or other VMs to CVM pages and mitigates remapping and double-mapping attacks. Crucially, the RMT also stores **memory permissions for each host physical page per VMPL over CVM**. This granular control allows the VMPL0 agent to define separate memory views, ensuring its isolation and giving it the necessary privileges to inspect other VMPLs' memory.

To enable remote communication between the trusted client and the VMPL0 agent, 00SEVen employs a novel approach. A virtual vQ device is attached directly to VMPL0, bypassing the untrusted guest OS and its peripherals. A network proxy at the cloud host layer then bridges TCP connections from the remote VM owner to this vQ device, effectively creating a direct, isolated communication path. To secure this channel, TLS endpoints are established at both the client and within the VMPL0 agent. Furthermore, the client performs AMD SEV-SNP remote attestation to cryptographically verify that the in-VM agent is indeed running in VMPL0 and is untampered, ensuring the integrity and authenticity of the introspection source.

Consider an example VMI operation: checking the process list for malware. The process list is typically stored in the kernel memory of the guest OS (VMPL1). The analyst first needs to locate the kernel page tables within VMPL1 using a known kernel symbol and offset. This allows translation of the virtual address of the process list (e.g., the init_task kernel symbol in Linux) to its GPA. The VMPL0 agent can then use its privileged access to map and read this GPA. Subsequently, the agent traverses the process list by issuing read requests, and if malware is detected, it can optionally access the process memory of the suspicious process.

A crucial prerequisite for such forensic analysis is securely pausing execution of the guest OS (VMPL1). This prevents in-VM attackers from manipulating memory or hiding traces while the inspection is underway. However, the untrusted hypervisor controls VM CPU scheduling and cannot be relied upon to pause VMPL1 securely. 00SEVen addresses this with an innovative mechanism:

1. The VMPL0 agent issues a new hypercall to the hypervisor, requesting a pause of VMPL1.
2. The hypervisor interrupts all VM CPUs currently executing in VMPL1 and pauses their scheduling.
3. Crucially, the in-VM agent then iterates through all VMPL1 register sets and disables virtualization support for them by flipping a specific hardware register. This means that any subsequent attempt by the untrusted hypervisor to resume VMPL1 execution will be hardware-blocked, guaranteeing that VMPL1 remains paused until the agent explicitly re-enables it. This mechanism ensures the integrity of the CVM state during introspection. The paper also details how access traps for memory accesses and kernel functions are enabled, further enhancing the VMI capabilities.

Demo / Proof of Concept

▶ Watch: Practical example: Inspecting a CVM's process list (7:00)

The efficacy of 00SEVen was validated through a comprehensive prototype implementation and evaluation. The researchers built their prototype for the Linux KVM/QEMU hypervisor and specifically targeted AMD SEV-SNP CVMs. The in-VM agent, residing in VMPL0, was developed based on the AMD Secure VM Service Module, leveraging its capabilities for secure operations within the confidential environment. For the client-side interaction and VMI policy execution, a backend was implemented using libVMI, a well-known library for virtual machine introspection.

The evaluation covered a range of scenarios, including 10 different VMI policies, multiple micro-benchmarks, and tests against various rootkits. The detailed results are available in the full paper, but the presentation highlighted key performance metrics. A 4KB page read operation, a fundamental primitive for VMI, demonstrated efficient performance:

• Approximately 0.1 milliseconds when using TCP (excluding network latency).
• Approximately 0.16 milliseconds when using TLS, which includes network latency.

When analyzing the breakdown of TLS-enabled read operations, the researchers found that TLS contributed about one-third to the overall runtime. This is primarily because the current in-VM agent prototype does not yet utilize CPU acceleration for TLS operations. The majority of the remaining overhead could be attributed to the message channel, specifically the context switches required between VMPL0, the hypervisor, the kernel, and the network proxy. This indicates areas for future optimization, particularly in TLS acceleration and minimizing context switching.

For evaluating VMI policies, such as the scanning of a process list, 00SEVen's performance was compared against KVM as a baseline, which performs VMI on regular (non-confidential) VMs on the same host system. Despite operating on CVMs and introducing additional security layers, 00SEVen demonstrated remarkably low overheads:

• When analyzing a CVM on the same host via TCP, 00SEVen incurred an overhead of only about 2% compared to the KVM baseline.
• Adding TLS for local communication increased the overhead by another 5%.
• For remote inspection, which inherently depends on network latency, the overhead was about 13% in the researchers' local network setup.
• The total overhead for remote TLS inspection was approximately 20%.

These results are highly encouraging. An overhead of around 20% for remote, secure introspection of confidential VMs is well within acceptable limits for many security monitoring and forensic use cases. The ability to perform complex VMI operations, such as detecting rootkits, with such a modest performance penalty, underscores the practical viability of 00SEVen in real-world confidential computing deployments. The demonstration effectively proved that the core design, including VMPL0 isolation, secure communication, and especially the novel secure pausing mechanism, functions as intended and provides the promised security benefits without prohibitive performance costs.

Defensive Implications

▶ Watch: Tackling the non-trivial challenge of pausing CVM execution (9:00)

00SEVen represents a significant advancement for defenders operating in confidential computing environments. Its primary implication is the re-establishment of critical security monitoring capabilities for workloads deployed in CVMs. Before 00SEVen, organizations faced a difficult trade-off: deploy sensitive applications in CVMs for strong host-level isolation but lose the ability to detect in-VM threats, or use regular VMs with VMI but expose them to a potentially untrusted host. 00SEVen eliminates this dilemma.

Defenders can now confidently deploy sensitive services and data within AMD SEV-SNP CVMs, benefiting from hardware-enforced protection against a malicious hypervisor or cloud provider. Concurrently, they can leverage 00SEVen to:

• Detect In-VM Attackers: Perform deep introspection to identify kernel rootkits, sophisticated malware, and other compromises that operate within the guest operating system, even if they attempt to hide their presence. This is crucial for maintaining the integrity and confidentiality of sensitive data and operations within the CVM.
• Enable Forensic Analysis: The secure pausing mechanism ensures that when an incident is suspected, defenders can pause the CVM's execution in a tamper-proof manner and collect forensic artifacts from a consistent state. This is vital for accurate incident response and post-mortem analysis.
• Enhance Trust in Cloud Deployments: By enabling secure remote inspection, 00SEVen allows organizations to verify the security posture of their CVMs independently, reducing their reliance on the cloud provider's assurances alone. The use of remote attestation ensures that the introspection agent itself is trustworthy and has not been tampered with.
• Integrate with Existing Security Workflows: The prototype's use of libVMI as a client backend suggests compatibility with existing VMI tools and frameworks, potentially easing integration into current security operations centers (SOCs) and incident response playbooks.
• Implement Proactive Security Policies: Defenders can define and enforce VMI policies (e.g., monitoring process lists, kernel hooks, memory regions) to continuously check the health and integrity of their CVMs, moving beyond reactive threat detection.

Ultimately, 00SEVen empowers defenders to embrace the full security potential of confidential computing without sacrificing visibility into their critical workloads. It allows for a layered defense strategy where hardware isolation protects against external threats, and in-VM introspection guards against internal compromises, providing a more robust and comprehensive security posture.

Key Takeaways

• Confidential VMs (CVMs) provide strong hardware-enforced isolation from the host but traditionally break VM introspection (VMI), a critical security monitoring capability.
• 00SEVen re-enables secure remote introspection for AMD SEV-SNP CVMs by deploying a trusted in-VM agent within the highly privileged VMPL0 domain.
• The system leverages AMD SEV-SNP's VM Privilege Levels (VMs) and Reverse Map Table (RMT) to ensure the agent's isolation and its ability to access other VMPLs' memory securely.
• A novel architecture for secure remote communication is established using a virtual vQ device, a host network proxy, TLS endpoints, and remote attestation for integrity verification.
• 00SEVen introduces an innovative secure pausing mechanism that prevents the untrusted hypervisor from resuming CVM execution during introspection, guaranteeing forensic integrity.
• The prototype implementation demonstrates practical feasibility with acceptable performance overhead, achieving remote TLS inspection with approximately 20% overhead compared to traditional VMI.

About the Speaker(s)

Fabian Schwarz is a PhD student at the CISPA Helmholtz Center for Information Security in Germany. His research focuses on virtual machine security, particularly in the context of confidential computing and enabling secure introspection capabilities for these highly isolated environments. His work on 00SEVen exemplifies his commitment to bridging the gap between strong hardware isolation and essential security monitoring.

Professor Christian Rossow is Fabian Schwarz's supervisor at the CISPA Helmholtz Center for Information Security. As a professor, he leads research in systems security, with a particular emphasis on network security, malware analysis, and virtual machine introspection. His guidance and expertise were instrumental in the development and realization of the 00SEVen project.