Control Flow Integrity in the Android kernel

guest · Oct 10, 2018

Control Flow Integrity in the Android kernel
October 10, 2018
https://android-developers.googleblog.com/2018/10/control-flow-integrity-in-android-kernel.html

Protecting against code reuse attacks
A common method of exploiting the kernel is using a bug to overwrite a function pointer stored in memory, such as a stored callback pointer or a return address that had been pushed to the stack. This allows an attacker to execute arbitrary parts of the kernel code to complete their exploit, even if they cannot inject executable code of their own. [...]
Conclusion
We have implemented support for LLVM's CFI in Android kernels 4.9 and 4.14. Google's Pixel 3 will be the first Android device to ship with these protections, and we have made the feature available to all device vendors through the Android common kernel.

LLVM's CFI protects indirect branches against attackers who manage to gain access to a function pointer stored in kernel memory. This makes a common method of exploiting the kernel more difficult. Our future work involves also protecting function return addresses from similar attacks using LLVM's Shadow Call Stack, which will be available in an upcoming compiler release.
Click to expand...

Log in or Sign up

Control Flow Integrity in the Android kernel

guest Guest

Log in or Sign up

Control Flow Integrity in the Android kernel

guest Guest

Useful Searches