Camouflage: Hardware-assisted CFI for the ARM Linux kernel

TL;DR

This paper introduces a hardware-assisted control flow integrity solution for the ARM Linux kernel using ARMv8.3 pointer authentication, achieving precise security with minimal performance impact.

Contribution

It presents a novel design leveraging ARMv8.3 PAuth for kernel CFI, demonstrating strong security guarantees on off-the-shelf processors.

Findings

Achieves precise kernel CFI with minimal performance overhead

Utilizes ARMv8.3 PAuth extension for security

Shows deployment differences between kernel and user space

Abstract

Software control flow integrity (CFI) solutions have been applied to the Linux kernel for memory protection. Due to performance costs, deployed software CFI solutions are coarse grained. In this work, we demonstrate a precise hardware-assisted kernel CFI running on widely-used off-the-shelf processors. Specifically, we use the ARMv8.3 pointer authentication (PAuth) extension and present a design that uses it to achieve strong security guarantees with minimal performance penalties. Furthermore, we show how deployment of such security primitives in the kernel can significantly differ from their user space application.