Sub-system Update: Kernel Self-Protection Project
summary
Year-in-review of defenses landed across kernels 4.14–4.19: concrete features include vmapped stacks, fast refcount_t protection backported to 4.14, SLUB freelist obfuscation, set_fs() checking, PTI, usercopy whitelisting, VLA removals and the stackleak plugin. Counts: 35 refcount conversions in 4.14 (about 32 left then), 51 VLAs removed in 4.17, 38 in 4.18, 33 in 4.19 with nine remaining. New overflow helpers already reveal at least one real bug. Kernel CVE lifetime averages around five to six years and edges slightly down.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:04Colonel Self-Protection Project
- 0:30Bug Life Time
- 6:07Clearing Unused Registers on X86
- 7:52Restrict Creating Files in Temp Directories
related talks
33mOverview and Recent Developments: Kernel Self-Protection Project
25mKernel Self-Protection Project
46mThe State of Kernel Self Protection Project
51m10 Years of Linux Security - A Report Card
52mKernel Hardening: Ten Years Deep
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
45mBreaking and Protecting Linux Kernel Stack
30mSpectre, Meltdown, & Linux