Getting on the Same (Virtual Memory) Page: A Roundtable on Data-only Attack Mitigations
Panelat Linux Security Summit North America 2025 · on Thursday, 2025-06-26· at 15:40· Bluebird Ballroom (BBB) 3GH·
summary
Kernel mutable state includes more than 20,000 mutable kernel data structures (example: corrupting struct file->f_op to hijack open/read/write). Survey compares concrete mitigations: hardware tagging (ARM MTE, TMDFI), ARM POE and kpkeys, AVF/PKVM virtualization, hypervisor introspection prototypes that verified fops but cost 15-minute boots, and compiler-based approaches like Clang plugins / LVM plugin to emit typed allocation metadata for runtime checks and per-write verification after modest vmalloc layout changes.
AI-written summary · about
chapters (6)
- 0:00Data-only attack mitigation intro
- 5:27Existing mitigation techniques
- 14:22Compiler-based solutions
- 16:47VM isolation and feasibility
- 25:18Future directions and challenges
- 33:32Q&A
related talks
41mUsing Microarchitectural Design to Break KASLR and More
27mProtecting Data In-Use from Firmware and Physical Attacks
38mKernel Hardening: Protecting the Protection Mechanisms
25mKernel Self-Protection Project
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
01h 03mret2dir: Deconstructing Kernel Isolation