A General Approach to Bypassing Many Kernel Protections and its Mitigation
summary
Shows that kernel “elastic” (flexible) objects let a limited heap write become a powerful info‑leak primitive that defeats KASLR, reveals stack canaries, heap cookies, function pointers and files like /etc/shadow. Static analysis finds 49 elastic structures and verification confirms 38 of them; testing 31 real CVEs shows 23 of 31 vulnerabilities enable KASLR bypass, 12 leak static data and 5 achieve arbitrary read. Builds a shadow‑cache isolation mitigation, measures <1% average overhead and demonstrates the defense blocks most tested exploits.
AI-written summary · about
chapters (12)
- 0:00Start
- 16:11Elastic Object is Not A New Attack in Windows
- 17:09Other Implementations of Elastic Object
- 18:34Elastic Objects for Leaking
- 20:15The Severity of Elastic Object Attack is clear • Obtain leak primitive from limited overwrite • The leak primitive can expose
- 20:53The Generality of Elastic Object Attack is Unknown
- 22:40Kernel/User Channel Functions
- 24:10Static Analysis to Pinpoint Elastic Objects
- 27:46Results in FreeBSD & XNU
- 29:31Potential Mitigations in Kernel
- 35:31Performance Evaluation of Our Proposed Mitigation
- 36:31Security Evaluation of Our Proposed Mitigation . Out of 31 vulnerabilities used to study the generality of elastic object attack Only two vulnerabilities can potentially be exploited after the mitigation anforced
related talks
18mExploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers
41mUsing Microarchitectural Design to Break KASLR and More
24mCurrent State of Exploit Mitigations in the Linux Kernel
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
45mAbusing Performance Optimization Weaknesses to Bypass ASLR
33mOverview and Recent Developments: Kernel Self-Protection Project
25mKernel Self-Protection Project
46mThe State of Kernel Self Protection Project