It's Coming From Inside the House: Kernelspace Fault Injection with KRF
Talkat Linux Security Summit North America 2019 · on Wednesday, 2019-08-21· at 12:00· Sapphire D, Hilton San Diego Bayfront·
summary
KRF is a kernelspace fault injector that literally replaces syscall table entries to return faults based on targeting (UID/GID/PID/personality) and a seeded RNG plus per-call probability; it runs on Linux >3.17, can reproduce failures by seed, and was built quickly as an unsafe module. It finds real issues—native component crashes and a Kubernetes weakness—by forcing rare syscall errors, but it trashes programs, produces many segfaults that require an offline triage pipeline, and is dangerous to run on production hosts.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 0:36Outline
- 1:35What is a fault
- 3:06Handling faults
- 4:10Faults cant be handled
- 6:03Exploit primitives
- 7:06Faults are rare
- 9:31Default Fault Injection
- 10:42Dynamic Linkage
- 13:04Dynamic Instrumentation
- 13:57introspection
- 14:41can we do better
- 16:32targeting
- 17:01targeting strategies
- 18:35KRF is a rootkit
- 19:17Care commands
- 20:20Does it work
- 21:52syscalls
- 22:36RNG
- 23:12Is it correct
- 24:25Faulting coverage
related talks
42mIdentifying Safety Weaknesses and Fault Propagation in the Linux Kernel
39mReal-Time Scheduling Fault Simulation
37mReal-time Scheduling Fault Simulation
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
41mUsing Microarchitectural Design to Break KASLR and More
50mBreaking Kernel Address Space Layout Randomization (KASLR) With Intel TSX
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process