Breaking and Protecting Linux Kernel Stack
Talkat Linux Security Summit North America 2019 · on Monday, 2019-08-19· at 13:45· Sapphire D, Hilton San Diego Bayfront·
summary
Kernel stacks move to vmalloc stacks with guard pages, remove thread_info and VLAs, and upstream the STACKLEAK cleanup, yet deterministic layout still enables stack-overflow and arbitrary read/write exploits. An introduced RANDOMIZE_KSTACK_OFFSET adds ~5 bits of entropy at syscall entry but requires fast randomness; microbenchmarks show getrandom-based seeding costs a few percent and some STACKLEAK-style defenses can cost tens of percent in pathological tests, so tradeoffs between mitigation strength and runtime overhead remain unresolved.
AI-written summary · about
chapters (19)
- 0:00SECURITY
- 1:48Linux thread stack for x86_64
- 7:09Buffer overflows
- 8:13Stack Overflows
- 9:18Uninitialized Stack
- 13:09Stackjacking
- 18:09Inter-stack exploitation
- 21:25A more recent example
- 23:46Stack Clash
- 25:05Basic measures for x86_64
- 25:43VMAP-based stack
- 26:23Variable-Length Arrays removal
- 26:50STACKLEAK and stack initialization
- 27:31Gap analysis
- 30:11In-stack randomization: comparison
- 31:18CONFIG_RANDOMIZE_KSTACK_OFFSET
- 35:01Performance, performance, performance.....
- 38:23Discussion & Conclusions
- 39:14References
related talks
34mSTACKLEAK: A Long Way to the Linux Kernel Mainline
18mExploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers
33mOverview and Recent Developments: Kernel Self-Protection Project
50mBreaking Kernel Address Space Layout Randomization (KASLR) With Intel TSX
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
37mDerandomizing Kernel Object Locations w Software Hardware-Induced Side Channels
11mSub-system Update: Kernel Self-Protection Project
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments