Video by The Linux Foundation via YouTube
Join us at the premier vendor-neutral open source conference, where developers and technologists come together to collaborate, share knowledge, and explore the latest innovations and advancements in open source technology. Learn more at https://events.linuxfoundation.org/
Security Implications of Kernel Electric Fence – Ernesto Martínez García, Graz University of Technology
With the continued rise of kernel heap vulnerabilities, the Linux kernel community has done substantial effort in hardening the slab allocator through defense-in-depth mechanisms.
Modern hardened kernels now rely on a combination of allocator-level protections, including type and size segregation, randomization, memory tagging, and others.
These mechanisms significantly raise the bar for exploiting kernel heap bugs, such as transforming a driver use-after-free vulnerability into a privilege escalation primitive.
However, the kernel memory-management subsystem is complex, and heap allocations do not necessarily follow a single uniform path.
In this presentation, we examine Kernel Electric Fence (KFENCE), a low-overhead, sample-based allocator designed to detect memory-safety errors in production systems. Enabled by default in RHEL, Fedora, Android, and other distributions.
We present how an attacker can target KFENCE-served allocations and use this alternative allocation path to weaken strong kernel heap hardening guarantees, such as type and size segregation or memory tagging.
Finally, we show the current status of the solution on upstream Linux.