WCU / Cybersecurity
HomeCSC 471CSC 472Search /
~/CSC 472/Class 10/KP 15
Class 10 · KP 15 / 20

How Each Mitigation Works

the exploit ↔ mitigation arms raceoverflowattackNX / DEPdefenseROP / ret2libcattackASLRdefenseinfo leakattackcanary / RELROdefenseCFI / CETattack
Each attack technique provoked a defense; each defense provoked a new attack.
  • KASLR: randomizes the kernel's base load address, so hardcoded symbol addresses fail — you need an info leak first.
  • SMEP (Supervisor Mode Execution Prevention): the CPU refuses to execute user-space pages while in ring 0, killing the old "point RIP at user shellcode" trick.
  • SMAP (Supervisor Mode Access Prevention): the CPU refuses to read/write user pages from ring 0 unless explicitly allowed — so you cannot cheaply stage payloads in user memory.
  • KPTI (Kernel Page-Table Isolation): separate page tables for user vs kernel; mitigates Meltdown and forces the trampoline return path.
  • Canaries / kCFI / hardening configs: detect stack smashing, constrain indirect calls, and shrink writable attacker-useful memory.
PreviousKernel Mitigations: Raising the BarNextModern Trends in Kernel Security