Finer Grained KASLR Patches Revived For The Linux Kernel To Enhance Security

Written by Michael Larabel in Linux Security on 7 September 2021 at 03:00 AM EDT. 4 Comments
LINUX SECURITY
For more than a year there has been work on FGKASLR for finer grained kernel address space layout randomization. While KASLR is widely-used these days, with enough guessing or unintentional kernel leakage, the base address of the kernel can be figured out. Finer grained KASLR allows for randomization at the per-functional level to dramatically boost defenses. The latest take on FG-KASLR has now been published.

FG-KASLR continues to be designed around rearranging the kernel code at boot/load-time on a per-function level with minimal impact to the boot time.

Alexander Lobakin took the FG-KASLR work started by Intel's Kristen Accardi and has performed a "massive rework and a respin" of those patches. The new code now allows controlling the number of functions per section depending upon your kernel image size / protection level preference along with a variety of other improvements over the earlier versions of the patches. Plus there are various fixes and re-basing against the latest upstream Linux state.

Those interested in this FG-KASLR work can see this "v6" patch series for more details on this one of many efforts around beefing up Linux kernel security.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week