Exploit Methods/Function pointer overwrite

From Linux Kernel Security Subsystem
Revision as of 16:17, 14 September 2016 by KeesCook (talk | contribs) (→‎Mitigations)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search


When an attacker has a write primitive, they can overwrite function pointers to redirect execution. Function pointers exist in a large number of places in the kernel ranging from function pointer tables (e.g. fops), to vector and descriptor tables.



  • mark function pointer tables "const" when they can be statically assigned, making them read-only for the entire kernel runtime.
  • use __ro_after_init on function pointer tables that are only written during __init so they are read-only during the rest of the kernel runtime.
  • make all function pointer tables read-only at compile time (e.g. PAX_CONSTIFY_PLUGIN).
  • make sensitive targets that need only occasional updates only writable during rare updates (e.g. PAX_KERNEXEC).