Android: Protecting the Kernel
summary
Dataset covers 2014–2015 through April and shows most Android kernel vulnerabilities live in vendor device drivers and are overwhelmingly missing bounds checks, not core kernel logic. Mitigations already upstream or landing include hardened_usercopy and privileged access never (PAN) emulation, KASLR and null-pointer mappings, KASAN/KCOV fuzzing, and ioctl whitelisting that cuts Wi‑Fi ioctl surface from hundreds to ~29; debugfs and perf access are disabled by default and seccomp is backported to constrain attack paths.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:44Good News
- 1:56Agenda
- 2:28A note
- 3:17Why this talk
- 3:45The data set
- 5:05The kernel
- 5:49Userspace bugs
- 6:08Is it increasing
- 10:08Kernel defenses
- 10:39Types of bugs
- 13:35Mitigations
- 15:34Heap Overflows
- 16:38NullPointer Dereferences
- 17:07Cobra View
- 21:10Attack Surface Reduction
- 23:04Bugs by Driver
- 26:53Bugs by Entrypoint
- 31:01Other Mitigation
- 32:17Impact of Mitigation
- 33:04Gaps
- 34:21Computer Safety
- 35:36Memory Safety
related talks
32mYear in Review: Android Kernel Security
53mThe Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
43mSecurity in Android Applications
33mOverview and Recent Developments: Kernel Self-Protection Project
42mHack, Patch, Repeat: Insider Tales from Android’s...
35mKernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections
27mAdaptive Android Kernel Live Patching
53mAndroid: He protec, but he also attac