Linux 5.13 Lands Support For Randomizing Stack Offsets Per Syscall
Written by Michael Larabel in Linux Security on 28 April 2021 at 08:53 AM EDT. 46 Comments
LINUX SECURITY --
One of the new security features in Linux 5.13 is the ability to randomize kernel stack offsets at each system call. This optional feature is now mainlined.

Randomizing the kernel stack offset per-system-call is intended to make it more challenging for rogue actors to carry out stack-based attacks on the Linux kernel. This has been in the works for over two years and was inspired by PaX's "RANDKSTACK" feature but the actual implementation has taken a different approach. Simply put though this randomizing of the kernel stack at each system call is to fend off exploits relying on kernel stack determinism.

At boot time the functionality can be toggled via the randomize_kstack_offset= parameter with on/off depending upon the desired behavior. x86/x86_64 and ARM64 are the initial architectures supported.

Enabling this randomize_kstack_offset feature is expected to incur around a 1% performance hit for at least some workloads. I'll be running some on/off benchmarks shortly.

More details on this randomizing kernel stack feature per system call can be found via this honored pull request in Linux 5.13.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week