A Hybrid Alias Analysis Framework and Its Application to Protecting the Linux Kernel
Talkat Linux Security Summit North America 2024 · on Friday, 2024-04-19· at 14:00· Terrace Suite 1+2·
summary
Presents a hybrid alias analysis that unifies data‑flow and type shortcuts, implemented as an on‑demand, per‑variable graph reachability engine on top of SVF/LLVM IR (SVF‑based graph reachability). Handles container_of, pointer casts and pointer arithmetic, analyzes 12,000 kernel globals in about an hour, and flags 5,000+ globals as ro_after_init (10× prior manual labels). Applying derived access rules prevents the 13 global‑variable exploits out of 37 examined from the last six years.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 1:24Kernel access control challenges
- 2:06Memory safety issues
- 3:50Read-only initialization limits
- 6:41Alias analysis for access control
- 7:46Existing alias analysis limits
- 9:11Data flow vs type-based tradeoffs
- 11:23Hybrid alias analysis
- 13:52Precision and scalability in UNS
- 16:47Type casting in kernel
- 18:58Pointer arithmetic issues
- 20:22UNS framework design
- 21:48UNS limitations and future
- 23:57Evaluation on Linux variables
- 26:25Protecting global variables
- 27:29Beyond access control
- 28:31Summary and contributions
- 29:15Q&A session part one
- 30:47Q&A session part two
- 33:00Q&A session part three
- 35:33Closing remarks
related talks
38mTaking Kernel Hardening to the Next Level
17mSoK: Multi-Layer Indirect Call Analysis in the Real World
35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
31mHow Double-Fetch Situations turn into Double-Fetch Vulnerabilities...
34mGetting on the Same (Virtual Memory) Page: A Roundtable on Data-only Attack Mitigations
15mEffective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers
38mStatic Code Analysis - A Behind-the-scenes Look