Adaptive Android Kernel Live Patching
summary
Study of 1,139 Android kernels finds most vulnerable functions stable across devices and 76 recent critical CVEs amenable to input-filtering fixes. KARMA implements adaptive live patching with patches written in a memory-safe Lua-like language, deployed as KARMA patches at level 1/2/3 pages (entry, call-site, or binary fallback). Offline symbolic-equivalence matching adapts a reference patch to target kernels; cloud-signed patches protect 520 tested devices with <1% overhead and only five CVEs requiring binary-level fixes.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 1:03Android Kernel Vulnerabilities
- 1:26The Problem
- 3:23Fragmented Ecosystem
- 3:51Adaptive Solution
- 4:44Ecosystem
- 5:02Annalee dataset
- 5:35Error code
- 5:50Input validation
- 6:56Safety
- 7:57MultiLevel Page
- 9:56patch
- 11:18other
- 11:33pagers
- 11:57architecture
- 12:58offline page
- 13:17steps
- 14:16function identification
- 15:23semantic equivalence
- 16:20example
- 17:13symbolic execution
- 17:34online page application
- 18:15current implementation
- 18:52statistics
- 19:29cluster
- 20:02function
- 21:16performance
- 22:30future work
- 24:08Questions
- 26:39Approach
related talks
47mAdaptive Kernel Live Patching: An Open Collaborative Effort...
18mKernel Live Patching: Mitigating CVEs With Zero Downtime
42mAndroid: Protecting the Kernel
39mLet's meet the kernel livepatch feature
41mKernel Live Patching at Scale
33mOverview and Recent Developments: Kernel Self-Protection Project
53mThe Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
08mTechnical debt