FGKASLR Patches Revised A 10th Time For Improving Linux Kernel Security
It was nearly two years ago to the day that FGKASLR was first published and it continues to be refined and now up to the "v10" patches while hopefully will make it mainline in the not too distant future. While Kernel Address Space Layout Randomization (KASLR) has been supported by the Linux kernel for a decade and a half to protecting against exploits that rely upon knowing known positions within memory, it isn't entirely effective. Through guessing addresses or accidental leakage of the base kernel address, KASLR can become less effective and that is what FGKASLR looks to address.
Finer-Grained KASLR (also referred to as Function Granular KASLR) provides function reordering on top of the KASLR base address randomization. In turn knowing function locations within system memory even if having the base address makes it harder to predict. The random function reordering is applied at boot-time.
FGKASLR does add some small amount of latency to the Linux boot time due to that dynamic function reordering. The run-time performance impact of FGKASLR can vary by workload due to the possibility of slightly higher cache misses.
The FGKASLR v10 patches re-base the series atop the latest Linux Git code and have a number of smaller technical changes/improvements throughout the patch series.
Those interested in checking out the latest on FGKASLR can see the v10 patch series from Intel's Alexander Lobakin via the kernel mailing list.
Add A Comment
