New Compat Vulnerabilities in Linux Device Drivers
summary
Prior audits find 30+ compat bugs; this work identifies a new class in device-driver ioctl paths where mixed compat ioctl mixing causes validation and conversion to be bypassed, producing out-of-bounds reads/writes and in some cases arbitrary kernel memory access. Kernel fuzzers (for example, Trinity) are extended with compat support to trigger real crashes and leaks. Concrete fixes are shown: use per-arch compat copies, validate user pointers before conversion, and avoid shared handlers that interleave 32/64 logic.
AI-written summary · about
chapters (7)
- 0:00Introduction and agenda
- 1:32Understanding compat mode
- 3:53Security risks in compat
- 5:26Analyzing driver defects
- 8:45Ioctl interface vulnerabilities
- 16:01Discovery and impact
- 18:51Mitigation and conclusion
related talks
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
06mQ&A
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
01h 16mClassic Vulnerabilities
31mHow Double-Fetch Situations turn into Double-Fetch Vulnerabilities...
32mEnhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis
30mSpectre, Meltdown, & Linux