Meaningful Bounds Checking in the Linux Kernel
summary
Audit of recent kernel CVEs finds 11 memcpy overflows (including BleedingTooth) that the compiler could have caught by using __builtin_object_size mode 1 instead of mode 0. Analysis of ~35,000 memcpy calls shows 22,000 with unknown destination size, 12,000 fully known, and ~1,200 (≈3%) dynamic-but-known-at-runtime where all CVEs live. Work underway adds a struct_group macro, flexible-array helpers, fortified memcpy replacement and new APIs plus staged compiler/runtime enforcement (fortify_source, UB sanitizer enablement) to prevent future overflows.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:48Array Index Overflows
- 5:00Bleeding Tooth
- 31:13Array Bounds
- 37:19How Do You Enforce the Usage of the New Macros like struct Group and New Code
- 44:25What Is the Second Most Common Cause of Cds
related talks
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
47mChallenges and Innovations Towards Spatial Safety in the Linux Kernel
01h 12mEnhancing Spatial Safety: Better Array-bounds Checking in C (and Linux)
01h 10mEnhancing Spatial Safety: Better Array-bounds Checking in C (and Linux)
39mMitigating Integer Overflow in C
46mProgress On Bounds Checking in C and the Linux Kernel
31mThe Bootloader: An Underestimated Risk To Embedded Linux Security
35mUpstream Kernel Hardening: Recent Progress and Challenges