Kernel Self-Protection Project
Talkat Linux Security Summit North America 2019 · on Wednesday, 2019-08-21· at 10:50· Sapphire D, Hilton San Diego Bayfront·
summary
Year-in-review of defenses landed across kernels 4.19–5.3: removal of VLA usage, conversions to overflow-checking refcounts, implicit-fallthrough annotations that reveal ~10% missing breaks, per-task stack canaries, read-only linear mapping and pinned CR0/CR4 bits to block trivial SMEP/SMAP bypasses, heap auto-initialization (boot option to zero kmalloc) and heap-mapping validation, slab/page freelist randomization, progress upstreaming CFI/LTO, and a breakage tester (LKDTM) that intentionally exercises mitigations; many features are landed but conversions and performance tuning continue.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:43Why is this important
- 4:38Bugfighting
- 5:25Car analogy
- 7:01Killing bugs
- 7:15Killing bug classes
- 7:36Exploitation methods
- 8:26Memory safety languages
- 8:50Kernel Subduction Project
- 9:37Kernel Updates
- 11:47Vulnerabilities
- 13:29Conversions
- 14:19Bugs
- 16:15More conversions
- 17:30Expected for 53
- 19:52Upcoming features
- 20:42Challenges
- 21:27Questions
related talks
11mSub-system Update: Kernel Self-Protection Project
33mOverview and Recent Developments: Kernel Self-Protection Project
46mThe State of Kernel Self Protection Project
52mKernel Hardening: Ten Years Deep
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
38mKernel Hardening: Protecting the Protection Mechanisms
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
35mUpstream Kernel Hardening: Recent Progress and Challenges