Re: [RFC][PATCH] Randomize kernel base address on boot

Ingo Molnar
2011-05-27T17:01:12Z

* Linus Torvalds <torvalds@linux-foundation.org> wrote:

> If you compile your own kernel version, you're already home free,
> and load-time randomization is pointless.

Most successful exploits work in two steps: first a local exploit
(weak password with a user, stupid script escaping bug, or a buffer
overflow somewhere), then a local kernel exploit to gain root and
kernel access. (for a rootkit and what not)

Straight remote root exploits are pretty rare - and per system
relinking only protects against that.

The problem with your relinking solution is that a local attacker can
easily figure out where the kernel is. So this does not protect
against the more common break-in scenario.

Kernel image randomization makes this last step really
indeterministic and thus dangerous to attackers.

Thanks,

Ingo