Главная
Study mode:
on
1
Intro
2
Control Flow Integrity (CFI) in the Linux kernel
3
Attack method: write to kernel code!
4
What is writable and executable?
5
Attack method: call into kernel code!
6
direct function calls
7
indirect calls: "forward-edge"
8
function returns: "backward-edge"
9
What contains writable func ptrs?
10
What can attacker call? Any executable bytel
11
CFI: forward-edge protection
12
Forward-edge protection in Clang
13
Stock: without Clang CFL
14
Protected: with Clang CFI
15
Jump tables and type mangling
16
Better implementation ideas?
17
CFI: backward-edge protection
18
Backward-edge protection in Clang
19
Gotchas
20
Upstreaming status
21
Do it yourself!
22
What do failures look like?
23
Thoughts?
Description:
Explore Control Flow Integrity (CFI) in the Linux kernel through this conference talk from linux.conf.au 2020. Dive into how Android utilizes Clang's CFI implementation for recent phones, the process of upstreaming this technology, and how to implement CFI yourself. Examine the code, data, and symbols Clang inserts to protect indirect calls, kernel modifications required for support, and remaining challenges. Gain insights into attack methods targeting function pointers, understand the differences between forward-edge and backward-edge protection, and witness a demonstration of CFI thwarting a kernel attack. Learn about jump tables, type mangling, implementation ideas, and potential gotchas in CFI adoption. Discover the current upstreaming status, how to identify CFI failures, and engage in thoughtful discussion about the future of kernel security.

Control Flow Integrity in the Linux Kernel

linux.conf.au
Add to list