Intra-Process Memory Protection for Applications on ARM and X86: Leveraging the ELF ABI
summary
A system uses the existing ELF ABI and a modified Linux loader to attach per-section access policies so code sections can only read or write designated data sections; ELFbac policies operate on ELF sections and require no changes to the GNU build chain. Prototypes for x86 and ARM exist: the x86 build enforces a policy that blocks the OpenSSH roaming leak (CVE‑2016‑0777) and the ARM prototype protects a DNP3 validating proxy under heavy fuzzing; ARM prototype protected DNP3 proxy. Measured overhead is about 5% on AMD and up to 30% on some Intel setups, and integration with a grsecurity/PAX variant is available.
AI-written summary · about
chapters (43)
- 0:00Intro
- 2:30buggy software
- 3:08missing software
- 4:24prototype
- 5:04Outline
- 6:02Background
- 7:56What Matters
- 10:03Composition
- 10:39Code Sections
- 11:47ELF File
- 12:36UDF
- 13:43QMail
- 14:34Isolation Worked
- 14:57Types
- 15:44Loaders
- 16:18Small model example
- 18:50OpenSSH
- 19:29OpenSSH Policy
- 20:16Demo
- 22:10Policies
- 23:15SSH
- 23:57SCADA
- 25:05Parser
- 27:05GrSec PACS
- 28:43Deep Dive
- 29:08Program Sections
- 29:39Linker
- 31:27Task struct
- 32:15VM struct
- 33:31Page tables
- 35:37Caches enforce policies
- 36:36Other layers
- 37:20Page fault
- 38:19Data model
- 39:57Page Faults
- 41:42Task Structures
- 42:19Performance Overheads
- 44:33ELF Backer
- 45:36ELF ABI Differences
- 46:12Page Handler Modifications
- 46:38enforceable contracts
- 47:41the takeaway
- 48:28Questions
related talks
42mDefending the Branch: PAC, BTI & GCS on Linux
33mKernel Runtime Security Instrumentation
19mDisARMed: Attacking ARM TrustZone from Userspace with Memory Aliasing
26mPorting and Generalizing Dynamic Privilege in Linux
21mEmbedded solution for multiprocess application
50mProtected KVM on Arm64: A Technical Deep Dive
35mZephyr OS Memory Protection
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM