According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer.
It is called KARL, "Kernel Address Randomized Link". This works by relinking internal kernel files in a random order so that it generates a unique kernel binary blob every time.
The technical explanation says;
A unique kernel is linked such that the startup assembly code is kept in the same place, followed by randomly-sized gapping, followed by all the other .o files randomly re-organized. As a result the distances between functions and variables are entirely new. An info leak of a pointer will not disclose other pointers or objects. This may also help reduce gadgets on variable-sized architectures, because polymorphism in the instruction stream is damaged by nested offsets changing.
- How does this improve security?
- What type of attacks would be mitigated by this new feature?
- How is this different from Kernel Address Space Layout Randomization?