Taking Kernel Hardening to the Next Level
summary
Proposes two concrete kernel defenses: KL tightens PA-based CFI by mixing type, object type and an invariant per-instance field and, when applied to Linux across 87 common struct targets, drops contexts shared by >100 indirect calls to 0% while adding ~7% runtime overhead on PA-capable hardware. Introduces a binary-level static validator to catch compiler-induced signing oracles. For UAF, BIG implements one-memory-access access validation using a compact base identifier scheme, with a full mode ≈20% overhead and a performance-first variant at 1–2% with reduced entropy.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:36Pointer Authentication Based CFI
- 5:10Context Based CFI
- 11:02New Context
- 18:21Complex Compiler Behavior
- 22:10Static Validator
- 26:58Use a Complete Difference
- 32:01Optimize Access Validation Approach
related talks
35mUpstream Kernel Hardening: Recent Progress and Challenges
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
52mKernel Hardening: Ten Years Deep
30mProactive Software Defense against Side Channel Attacks
35mDoes Making the Kernel Harder Make Making the Kernel Harder?
58mFineIBT Enhanced: Hardening Linux’s Microarchitectural Security on X86
25mKernel Self-Protection Project
30mKernel Hardening With Protection Keys