Control Flow Integrity in the Linux Kernel
summary
Linux kernel gets forward-edge checks by inserting per-type jump tables and runtime validation using Clang/LLVM CFI, requires whole-kernel visibility via thin LTO to collect targets, and adds an arm64 shadow call stack (x18) for backward-edge protection. Pixel 3/4 devices already ship it; upstreaming targets kernel 5.7–5.8. Build pain points are link memory/time, assembly and module handling, and C prototypes that need fixing. A permissive mode prints call traces; strict mode panics—demo shows CFI can abort a real kernel pointer hijack.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:11Control Flow Integrity (CFI) in the Linux kernel
- 2:43Attack method: write to kernel code!
- 3:17What is writable and executable?
- 4:28Attack method: call into kernel code!
- 5:05direct function calls
- 6:15indirect calls: "forward-edge"
- 6:30function returns: "backward-edge"
- 6:53What contains writable func ptrs?
- 7:41What can attacker call? Any executable bytel
- 8:29CFI: forward-edge protection
- 10:20Forward-edge protection in Clang
- 11:34Stock: without Clang CFL
- 12:07Protected: with Clang CFI
- 13:57Jump tables and type mangling
- 14:44Better implementation ideas?
- 17:30CFI: backward-edge protection
- 18:11Backward-edge protection in Clang
- 23:18Gotchas
- 26:34Upstreaming status
- 29:59Do it yourself!
- 31:54What do failures look like?
- 33:04Thoughts?
related talks
45mControl Flow Integrity in the Linux Kernel
44mLinux Kernel Control-Flow Integrity Sup...
35mControl Flow Integrity on RISC-V Linux
27mFiner-grained kernel control flow integrity and challenges
01h 46mA little Introduction to Control Flow Integrity
20mControl Flow Integrity on RISCV
01h 34mA Little Introduction to Control Flow Integrity in C++
19mSecuring the Hypervisor with Control-Flow Integrity