How I research

Linux kernel security

from security researchers

Sabyrzhan “novitoll” Tasbolatov

Spectre Security Group

Spectre Security Group

whom I research

Spectre Security Group

• Dmitry Vyukov, Andrey Konovalov - Google dynamic tools team
• Alexander Popov - Positive Technologies
• Vitaly Nikolenko - Duasynt
• Brad Spengler & PaX team - grsecurity/PaX
• Kees Cook - Google
• Maddie Stone - Google P0

Spectre Security Group

some info might be incorrect due to

either lack of knowledge or misunderstanding the info from the source

Spectre Security Group

https://a13xp0p0v.github.io/img/Alexander_Popov-KSPP_lessons.pdf

KASAN, KMSAN, KCSAN

Spectre Security Group

• Tale of 1000 kernel bugs,

Dmitry Vyukov, 2018

​

​

• KASAN in a bare-metal hypervisor, Alexander Popov, 2016

​

• Coverage-Guided USB fuzzing with syzkaller, Andrey Konovalov, 2019

Spectre Security Group

Brad Spengler - 10 years of Linux security

• KSPP mail list is not healthy?
• YAMA LSM
• symlink TOCTTOU, hardlink, ptrace
• >= Ubuntu 10 ptrace call is allowed only for child processes
• openssh, systemd is secured against ptrace debugging
• bpf based seccomp

eBPF

Spectre Security Group

• Userspace sends bytecode to the kernel together with a program type which determines what kernel areas can be accessed.

​

• The kernel runs a verifier on the bytecode to make sure the program is safe to run (kernel/bpf/verifier.c).

​

• The kernel JiT-compiles the bytecode to native code and inserts it in (or attaches to) the specified code location.

​

• The inserted code writes data to ringbuffers or generic key-value maps.

​

• Userspace reads the result values from the shared maps or ringbuffers.

https://www.collabora.com/news-and-blog/blog/2019/04/05/an-ebpf-overview-part-1-introduction/

GCC plugins

Spectre Security Group

• Emese Revfy gcc-plugins
• Linux: scripts/gcc-plugins/cyc_complexity_plugin.c
• Linux: scripts/gcc-plugins/stackleak_plugin.c

​

​

​

https://github.com/torvalds/linux/blob/master/scripts/gcc-plugins/cyc_complexity_plugin.c

STACKLEAK in Linux mainline

Spectre Security Group

grsecurity / PaX teams

Spectre Security Group

https://raw.githubusercontent.com/a13xp0p0v/linux-kernel-defence-map/master/linux-kernel-defence-map.svg

Tough 2018

Spectre Security Group

• June, 2017 - Qualys’ post about Stack Clash
• January, Meltdown & Spectre
• March, VLA and problematic max()
• September, Linus vacation

https://a13xp0p0v.github.io/img/Alexander_Popov-KSPP_lessons-Linux_Piter_2018.pdf

Google Project Zero blog.

In-the-wild exploits for Linux, Android

Spectre Security Group

https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html

Spectre Security Group

https://googleprojectzero.blogspot.com/2021/01/in-wild-series-android-exploits.html

Spectre Security Group

https://android.googlesource.com/platform/bionic/+/android-4.2_r1/linker/README.TXT

Spectre Security Group

Points to an array of function addresses that must be called, in-order, to perform initialization. Some of the entries in the array can be 0 or -1, and should be ignored.

​

Note: this is generally stored in a .init_array section

​

Thanks! Questions?

Spectre Security Group

Sabyrzhan “novitoll” Tasbolatov

Spectre Security Group