HotBPF - An On-demand and On-the-fly Memory Protection for the Linux Ker...
summary
HotBPF identifies vulnerable slab objects from sanitizer and kernel crash reports, maps source allocation sites to binary addresses with debug info, and injects eBPF hooks that divert those allocations into a vmalloc region and enforce one-time allocation so freed vulnerable objects are never reclaimed. Evaluation reproduces 46 reports from 25 real bugs with no false negatives; worst-case diverted allocation adds ~23,000 ns while end-to-end overhead averages 2% - 3% performance overhead. Deployable on-the-fly without reboot.
AI-written summary · about
chapters (12)
- 0:00Start
- 4:35SLAB-based Exploitation (cont.)
- 6:17The Key Idea of HotBPF
- 7:24Technical Challenges
- 10:39Overview of HotBPF
- 14:54Technical Details - Vulnerable Object Identific
- 16:27Technical Details - Dynamic Separation Enfc
- 18:02Technical Details - One Time Allocation
- 18:53Implementation Details
- 20:37Evaluation Setup
- 22:35Evaluation of Vulnerable Object Identificatic
- 24:09Performance Evaluation in the Linux Kernel
related talks
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel
27mDetecting Double Free With BPF
36mObservability and performance analysis with BPF
29meBPF on the Rise - Getting Started
34mWhat's new in the BPF world?
57mBPF and Security. Friends and Foes
42mResolving Performance and Security Issues with eBPF
30mWhen BPF programs need to die: exploring the design space for early BPF...