Mitigating Integer Overflow in C
Talkat Linux Security Summit North America 2024 · on Thursday, 2024-04-18· at 11:10· Terrace Suite 1+2·
summary
Kernel work shows hundreds of CVEs tied to integer overflow over the last decade and pushes concrete fixes: extend sanitizers to detect overflows regardless of resolution, teach compilers to recognize common idioms, and add a wraps typedef attribute so types like u32_wp mean intentional wrap. Builds use -fno-strict-overflow, Coccinelle edits and check_add_overflow, clang 19 lands a sanitizer fix, Linux 6.9–6.11 schedule enables testing and incremental rollout.
AI-written summary · about
chapters (18)
- 0:00The problem of overflows
- 1:41Understanding C overflows
- 7:18Available sanitizers
- 8:21Sanitizer limitations
- 8:58Refining sanitization
- 9:15Fixing sanitization logic
- 13:08Refactoring strategies
- 14:09Automated patching
- 14:27Introducing wrapping types
- 17:51Loop and constant issues
- 18:36Catching real-world flaws
- 21:32Implicit truncation issues
- 22:05Advanced sanitization
- 22:41Kernel development roadmap
- 23:40Future implementation plans
- 31:46Handling implicit conversions
- 33:58Exception handling in C
- 34:09Fuzzing and trap context
related talks
01h 00mint != safe && int != ℤ
46mMeaningful Bounds Checking in the Linux Kernel
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
34mMaking C Less Dangerous
01h 16mClassic Vulnerabilities
01h 30mDangerous Optimizations in C and C++ Programming Languages
52mKernel Hardening: Ten Years Deep
35mUpstream Kernel Hardening: Recent Progress and Challenges