Identifying Safety Weaknesses and Fault Propagation in the Linux Kernel

on YouTube ↗42m

" summary

A reproducible fault-injection tool targets kernel control structures on ARM64 by letting a monitor spawn a victim process, locating its instance via a structure DB, and applying deterministic corruptions (write zeros, 0xFF, random pointers) from an interference generator. The workflow measures whether safety monitors report the fault reliably and within the car-relevant timing budget (tens of milliseconds) and computes hit rates over many runs; hypervisor trapping costs (~5,000 cycles) and which fields actually break safety are reported, and the tool can run against post-release kernels.

AI-written summary · about

" chapters (6)

1. 0:00Introduction and context
2. 1:02The problem of safety
3. 6:58Theory and practices
4. 14:23Reusing and recycling methods
5. 24:00Attempted safety remedies
6. 32:12Fault injection methodology

" related talks

• 26mIt's Coming From Inside the House: Kernelspace Fault Injection with KRFWilliam Woodruff · Linux Security Summit North America 2019
• 44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019Tong Lin, Luhai Chen · Linux Security Summit Europe 2019
• 28mkAFL: Hardware-Assisted Feedback Fuzzing for OS KernelsSebastian Schinzel, Thorsten Holz, Cornelius Aschermann, Sergej Schumilo, Robert Gawlik · 26th USENIX Security Symposium (USENIX Security '17)
• 28mComplexity Killed SecurityDaniel Gruss · Black Hat Asia 2020
• 32mHow to Backdoor the Linux Kernel (and fail?)Konstantin Ryabitsev · Linux Security Summit North America 2023
• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017
• 48mCapturing 0Day Exploits With Perfectly Placed Hardware TrapsCody Pierce, Matt Spisak, Kenneth Fitch · Black Hat USA 2016
• 43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the ProcessDaniel Gruss, Anders Fogh · Black Hat USA 2016