OpenBSD is implementing KARL. How does this improve security?

Question

According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer.

It is called KARL, "Kernel Address Randomized Link". This works by relinking internal kernel files in a random order so that it generates a unique kernel binary blob every time.

The technical explanation says;

A unique kernel is linked such that the startup assembly code is kept in the same place, followed by randomly-sized gapping, followed by all the other .o files randomly re-organized. As a result the distances between functions and variables are entirely new. An info leak of a pointer will not disclose other pointers or objects. This may also help reduce gadgets on variable-sized architectures, because polymorphism in the instruction stream is damaged by nested offsets changing.

• How does this improve security?
• What type of attacks would be mitigated by this new feature?
• How is this different from Kernel Address Space Layout Randomization?

Answer 1

From what I understand, this is a step beyond KASLR. For memory location inferences at a finer granularity than what KASLR protects.

With KASLR, you make it harder for ROP gadgets to overwrite (e.g., heap spray) areas of memory that will eventually yield control to injected/known code. However, this being an arms race, counter moves such as JIT spray have evolved.

An info leak of a pointer will not disclose other pointers or objects.

As with ASLR which randomizes and hence makes it harder to "find" userland function entry points to tamper, and KASLR doing the same thing - both are still vulnerable - if an attacker can

1. study the way the kernel components are linked and loaded into memory relative to each other
2. then "find one point of reference" (in this case, by an info leak of a pointer") and then
3. apply the earlier knowledge to infer the locations of other sensitive objects / functions that could be targeted by gadgets.

How does this improve security?

Apparently, KARL makes this inference much harder because you'll need to study (1) afresh after every reboot. This raises the cost of exploitation significantly (except in a situation where attacker doesn't even need to reboot even as they mess with kernel in a largely hit and miss technique) - and thus makes the OS more secure.

What type of attacks would be mitigated by this new feature?

Gadgets that depend on inferring kernel object locations based on a separately "knowledge of" a point of reference.

How is this different from Kernel Address Space Layout Randomization?

This is an additional defense on top of KASLR. To defend against use of gadgets that work at a finer granularity that what KASLR defends against.