Adelie: Continuous Address Space Layout Re-randomization for Linux Drivers
Ruslan Nikolaev, Hassan Nadeem, Cathlyn Stone, Binoy Ravindran

TL;DR
Adelie enhances Linux kernel security by implementing continuous address space layout re-randomization, increasing entropy, and encrypting addresses to significantly hinder ROP attacks, especially on device drivers.
Contribution
Adelie introduces a novel approach combining position-independent code, stack re-randomization, and address encryption to improve kernel and driver security against ROP attacks.
Findings
Increases KASLR entropy and attack difficulty
Effectively prevents ROP gadget injection from modules
Maintains high efficiency in re-randomization techniques
Abstract
While address space layout randomization (ASLR) has been extensively studied for user-space programs, the corresponding OS kernel's KASLR support remains very limited, making the kernel vulnerable to just-in-time (JIT) return-oriented programming (ROP) attacks. Furthermore, commodity OSs such as Linux restrict their KASLR range to 32 bits due to architectural constraints (e.g., x86-64 only supports 32-bit immediate operands for most instructions), which makes them vulnerable to even unsophisticated brute-force ROP attacks due to low entropy. Most in-kernel pointers remain static, exacerbating the problem when pointers are leaked. Adelie, our kernel defense mechanism, overcomes KASLR limitations, increases KASLR entropy, and makes successful ROP attacks on the Linux kernel much harder to achieve. First, Adelie enables the position-independent code (PIC) model so that the kernel and its…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
