Compartmentalizing Vulnerable Kernel Components Without Stopping the Machine
summary
Claims an on-the-fly enforcement that quarantines vulnerable kernel objects without rebooting by auditing pre-existing “legacy” objects and blocking illegal accesses. Implements O2C: an eBPF-based quarantine, a compiled decision tree ML model embedded in kernel (no floating point), and static binary instrumentation. Demo exploits CVE-2022-0995 and stops it; dataset shows >10,000 legacy objects live >10s with 22 average modifications; authors report negligible overhead and good scalability; code on GitHub.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:24Problem background
- 3:11Existing solution limits
- 7:16Legacy objects challenge
- 8:03Auditing Legacy objects
- 11:22eBPF and ML background
- 13:54Approach overview
- 15:20Object profiler details
- 17:28Code analyzer
- 19:59Quarantine mechanism
- 20:41Exploit prevention demo
- 23:57Model evaluation
- 26:45Limitations and future
- 27:29Q&A
related talks
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
30mFinding Imposter Among Us: Container Edition
14mWill eBPF Save Us From the Next Global Outage?
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
45mThe Container Escape Room: An Exploration of Container Escapes
24mShielding Software From Privileged Side-Channel Attacks
42mResolving Performance and Security Issues with eBPF
30mProactive Software Defense against Side Channel Attacks