Kernel Hardening: Ten Years Deep
Talkat Linux Security Summit North America 2025 · on Thursday, 2025-06-26· at 09:05· Bluebird Ballroom (BBB) 3GH·
summary
Project started in 2015, created measurable results: average CVE lifetime drops after years of stagnation and many buffer and integer overflow classes fall toward zero; dozens of mitigations land upstream (vmap stack, W^X, KASLR, slab hardening, %p hashing, IBT/BTI, KCFI) and policy features arrive (seccomp, __ro_after_init, lockdown). Use‑after‑free rates rise into the hundreds per year, driving per‑allocator fixes (slab virtual, cross‑cache defenses), hardware tagging (ARM MTE), and compiler extensions like zero‑initialize stack and counted_by attribute implemented across GCC/Clang.
AI-written summary · about
chapters (12)
- 0:00Introduction and context
- 0:41History of kernel security
- 5:23Impact assessment transition
- 6:56Visualizing kernel flaws
- 7:54New CNA data mapping
- 8:42Statistical approach
- 9:14Vulnerability trends and UAF
- 23:06C language ambiguity
- 23:18Removing ambiguity
- 24:06Compiler and Rust integrations
- 32:09Q&A: Mitigations and tools
- 38:00Q&A: Compiler standards and future
related talks
35mUpstream Kernel Hardening: Recent Progress and Challenges
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
46mThe State of Kernel Self Protection Project
25mKernel Self-Protection Project
01h 34mSecurity in C++ - Hardening Techniques From the Trenches
35mDoes Making the Kernel Harder Make Making the Kernel Harder?
38mTaking Kernel Hardening to the Next Level
34mMaking C Less Dangerous