How to Backdoor the Linux Kernel (and fail?)
summary
Survey of realistic attack paths into the kernel release pipeline concludes that patch submission, merge and publish points are all attackable but are usually detected: CI fuzzers and many eyes catch intentional bugs, git commit signing and a transparency log make tampering evident, and a background verifier called sigprover downloads tarballs and alerts on bad signatures. Adoption is low — fewer than ten people use the automated signing workflow routinely — kernel.org was compromised about 12 years ago, and unpatched critical flaws currently exist.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 1:36The Linux kernel pipeline
- 4:11Attacking the patch workflow
- 8:31Security tools and practices
- 13:34Protecting infrastructure
- 18:13Addressing supply chain risks
- 22:13Verification of releases
- 24:21The reality of kernel security
- 28:15Q&A and concluding remarks
related talks
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
06mQ&A
24mCurrent State of Exploit Mitigations in the Linux Kernel
21mFrom CVEs To Compliance: Automating Embedded Linux Kernel Security
42mIdentifying Safety Weaknesses and Fault Propagation in the Linux Kernel
51m10 Years of Linux Security - A Report Card
42mBeyond Kubernetes Security
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel