STACKLEAK: A Long Way to the Linux Kernel Mainline
summary
STACKLEAK erases kernel stack state at syscall exit and adds compile‑time instrumentation to stop three attack classes: information leaks, uninitialized-stack writes, and Stack Clash. Implementation extracts PaX code, rewrites the erase routine from assembly into C, fixes GCC plugin bugs, adds trampoline stack and arm64/GCC8 support, and ships a GCC plugin for stack tracking and alloca checks. Upstreaming takes 15+ patch rounds over a year; measured impact is <1% build penalty, ~4% on short‑syscall workloads. Core behavior is erases used kernel stack at syscall exit.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:43History
- 1:10Positive Technologies
- 1:32What did I do
- 2:14What does it provide
- 3:00StayClick
- 3:53Bugs
- 4:07How it looks
- 4:51Erase function
- 5:25Uninitialized kernel stack
- 5:47Three system calls
- 6:53Mitigation
- 7:47Limitation
- 8:29Config Options
- 9:05How does it work
- 10:19What does it do
- 11:19Synthetic test
- 11:51Conclusion
- 13:57Timeline
- 20:18Changes from original version
- 21:43New functionality
- 23:03Dropping functionality
- 24:41Strong language
- 25:56Closing thoughts
- 26:13STACKLEAK in C
- 26:47Helper Stack
- 31:10Conclusions
related talks
18mExploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers
45mBreaking and Protecting Linux Kernel Stack
36mStore-to-Leak Forwarding: There and Back Again
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
33mOverview and Recent Developments: Kernel Self-Protection Project
25mKernel Self-Protection Project
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
24mGuarded Control Stack on arm64: Challenges in Enabling Shadow Stack Support...