Linux's SLUB Allocator Preparing To Better Fend Off Cross-Cache Attacks

Following SLOB's removal and SLAB being deprecated and set for removal, the Linux kernel is all-in on the SLUB allocator. A new patch series posted on Friday is aiming to help prevent the possibility of cross-cache attacks with the SLUB memory allocator in the kernel.

Google engineer Matteo Rizzo explains of this cross-cache attack prevention for SLUB:

"The goal of this patch series is to deterministically prevent cross-cache attacks in the SLUB allocator.

Use-after-free bugs are normally exploited by making the memory allocator reuse the victim object's memory for an object with a different type. This creates a type confusion which is a very powerful attack primitive.

There are generally two ways to create such type confusions in the kernel: one way is to make SLUB reuse the freed object's address for another object of a different type which lives in the same slab cache. This only works in slab caches that can contain objects of different types (i.e. the kmalloc caches) and the attacker is limited to objects that belong to the same size class as the victim object.

The other way is to use a "cross-cache attack": make SLUB return the page containing the victim object to the page allocator and then make it use the same page for a different slab cache or other objects that contain attacker-controlled data. This gives attackers access to all objects rather than just the ones in the same size class as the target and lets attackers target objects allocated from dedicated caches such as struct file.

This patch prevents cross-cache attacks by making sure that once a virtual address is used for a slab cache it's never reused for anything except for other slabs in that cache."

The patch series is initially out under a request for comments (RFC) in seeing the feedback from other stakeholders. This functionality is enabled with the new "SLAB_VIRTUAL" Kconfig option where when enabled slab objects are allocated from kernel virtual memory and that the virtual memory used as a slab cache is never reused to store objects from other slab caches or non-slab data.

The patch series doesn't provide any benchmarks or any initial insight into the expected performance overhead of this cross-cache attack mitigation.