The State of Kernel Self Protection Project
summary
Project quantifies risk and ships mitigations: analysis of 557 CVEs shows about a 5 year average lifetime for many kernel bugs, so defenses must assume bugs exist. Work pulls PaX/grsecurity ideas into mainline: GCC plugin infrastructure lands; RO-data and execute-only memory and KASLR work reach mainline; SLAB/SLUB free-list randomization and JIT constant blinding are deployed; usercopy hardening is in progress. Key blockers are cultural conservatism, backport effort, invasive per-architecture changes and occasional performance/maintainability tradeoffs.
AI-written summary · about
chapters (25)
- 0:00Status of the Kernel Self Protection Project
- 1:39Kernel Security
- 2:34Devices using Linux
- 4:53Upstream Bug Lifetime
- 8:36Fighting Bugs
- 13:25Killing bugs is nice
- 14:30Killing bug classes is better
- 14:44Killing exploitation is best
- 19:33Developers under KSPP umbrella
- 20:43Bug class: Stack Overflow
- 21:51Bug class: Integer overlunderflow
- 22:18Bug class: Heap Overflow
- 23:12Bug class: format string injection
- 23:55Bug class: kernel pointer leak
- 25:22Bug class: uninitialized variables
- 26:31Exploitation finding the kernel
- 27:58Exploitation Direct kernel overwrite
- 28:59Exploitation: function pointer overwrite
- 30:54Exploitation: userspace execution
- 31:56Exploitation: userspace data
- 33:07Exploitation Reused code chunks
- 37:27Crystal Ball predictions for 4.9
- 38:06Challenge Culture
- 39:28Challenge: Technical
- 40:32Challenge: Resources
related talks
33mOverview and Recent Developments: Kernel Self-Protection Project
25mKernel Self-Protection Project
51m10 Years of Linux Security - A Report Card
52mKernel Hardening: Ten Years Deep
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
11mSub-system Update: Kernel Self-Protection Project
30mProactive Software Defense against Side Channel Attacks
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation