LinuxCon + CloudOpen + ContainerCon NA 2015

Memory access bugs, including buffer overflows and uses of freed memory, are a serious problem for Linux kernel. These bugs not only lead to crashes, but also introduce exploitable vulnerabilities. Many memory error detectors exist for user-space applications, but only a few for Linux kernel, and most of them are either slow or detect a limited set of bugs, or both.

This paper presents KernelAddressSanitizer, a new dynamic memory error detector for Linux kernel. Our tool finds out-of-bounds accesses to heap, stack, and global objects, as well as use-after-free bugs. The tool is based on compiler instrumentation an uses similar ideas as the user-space memory bug detector AddressSanitizer.

KernelAddressSanitizer is efficient and accurately detects bugs at the point of occurrence. It has found over 50 previously unknown bugs in Linux kernel.