Thwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
summary
Kernel hardening reduces exploitability by adding concrete defenses now in mainline: debug_rodata and module RO mappings enforce page permissions (read/execute/data separation) with minimal runtime cost; stack protector and canaries stop many stack-overflows; KASAN finds use-after-free/out-of-bounds in testing and UBSAN catches undefined-behavior at runtime; user/kernel segregation via PAN/SMEP/SMAP prevents executing or reading user-controlled pages. Hundreds of long-lived kernel CVEs and average lifetimes over five years motivate enabling these options; some are slated to be mandatory on arm64 and x86.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 3:38What is hardening
- 6:04DebugRoData
- 9:31Stack Smashing Protection
- 13:10User Memory Segregation
- 18:55Kernel Address Sanitizer
related talks
35mUpstream Kernel Hardening: Recent Progress and Challenges
42mLinux Kernel Hardening Techniques
35mDoes Making the Kernel Harder Make Making the Kernel Harder?
52mKernel Hardening: Ten Years Deep
38mKernel Hardening: Protecting the Protection Mechanisms
46mThe State of Kernel Self Protection Project
38mTaking Kernel Hardening to the Next Level
06mQ&A