Kernel modules and security – an overview

An ironic reality is that enormous efforts spent on improving user space security considerations have resulted in a pretty large payoff over recent years. A malicious user performing a viable Buffer Overflow (BoF) attack was well within the realms of possibility a couple of decades back, but today is really hard to do. Why? Because there are many layers of beefed-up security mechanisms to prevent many of these attack classes.

To quickly name a few countermeasures: compiler protections (-fstack-protector[...],
-Wformat-security, -D_FORTIFY_SOURCE=2, partial/full RELRO, better sanity and security checker tools (checksec.sh, the address sanitizers, paxtest, static analysis tools, and so on), secure libraries, hardware-level protection mechanisms (NX, SMEP, SMAP, and so on), [K]ASLR, better testing (fuzzing), and so on.

The irony is that kernel-space attacks have become increasingly common over the last few years! It has...