~/talk

Let's meet the kernel livepatch feature

on YouTube 39m
Talkat Ubuntu Summit 2022 · 2022-11-07..11-09· [linux-and-operating-systems, security]

speaker

name:Marek Maślanka
links:none on file

resources

video:https://youtu.be/5iDteeKT_aM
slides:none on file

summary

Kernel livepatching updates kernel functions at runtime by loading a kernel module that uses ftrace nop->call trick to reroute callers (it replaces a return address to jump into the patched function). Demonstrations on Ubuntu VM build modules for CVE-2021-2235 and another privilege escalation, load them, and the exploits stop working — so the patches work. Handling non-exported symbols requires ELF edits (adding klp symbols and relocation sections). Tools mentioned: Deco and kpatch available. Performance impact is small; ARM support remains lacking.

AI-written summary · about

chapters (7)

  1. 0:00Start
  2. 0:47What is a Kernel Livepatch
  3. 2:52How it works
  4. 6:22Prepare the patch
  5. 9:09Demo
  6. 14:30Example
  7. 17:54ELF Relocations

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.