5

According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer.

It is called KARL, "Kernel Address Randomized Link". This works by relinking internal kernel files in a random order so that it generates a unique kernel binary blob every time.

The technical explanation says;

A unique kernel is linked such that the startup assembly code is kept in the same place, followed by randomly-sized gapping, followed by all the other .o files randomly re-organized. As a result the distances between functions and variables are entirely new. An info leak of a pointer will not disclose other pointers or objects. This may also help reduce gadgets on variable-sized architectures, because polymorphism in the instruction stream is damaged by nested offsets changing.

  • How does this improve security?
  • What type of attacks would be mitigated by this new feature?
  • How is this different from Kernel Address Space Layout Randomization?
4

From what I understand, this is a step beyond KASLR. For memory location inferences at a finer granularity than what KASLR protects.

With KASLR, you make it harder for ROP gadgets to overwrite (e.g., heap spray) areas of memory that will eventually yield control to injected/known code. However, this being an arms race, counter moves such as JIT spray have evolved.

An info leak of a pointer will not disclose other pointers or objects.

As with ASLR which randomizes and hence makes it harder to "find" userland function entry points to tamper, and KASLR doing the same thing - both are still vulnerable - if an attacker can

  1. study the way the kernel components are linked and loaded into memory relative to each other
  2. then "find one point of reference" (in this case, by an info leak of a pointer") and then
  3. apply the earlier knowledge to infer the locations of other sensitive objects / functions that could be targeted by gadgets.

How does this improve security?

Apparently, KARL makes this inference much harder because you'll need to study (1) afresh after every reboot. This raises the cost of exploitation significantly (except in a situation where attacker doesn't even need to reboot even as they mess with kernel in a largely hit and miss technique) - and thus makes the OS more secure.

What type of attacks would be mitigated by this new feature?

Gadgets that depend on inferring kernel object locations based on a separately "knowledge of" a point of reference.

How is this different from Kernel Address Space Layout Randomization?

This is an additional defense on top of KASLR. To defend against use of gadgets that work at a finer granularity that what KASLR defends against.

  • "On top of KASLR" is a bit of a misnomer, as KASLR provides little to no security. Public side-channel attacks have been able to defeat it completely for years, even if accidental infoleaks didn't exist. If I recall correctly, even some unprivileged instructions (such as SIDT, which will be blocked when UMIP comes out) can be used to break KASLR, at least on older kernels. – forest Mar 7 '18 at 6:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.