Chaos: Function Granularity Runtime Address Layout Space Randomization for Kernel Module

The return-oriented programming (ROP) is a prevalent code reuse attack. It exploits vulnerabilities such as stack overflows to hijack the execution flow into the carefully chosen instruction snippet (called gadget) chain already in the memory. Address Space Layout Randomization (ASLR) is widely used to defend against code reuse attacks like ROP from hijacking control flow. However, the Linux kernel, especially the most vulnerable kernel module, only applies basic coarsegrained load-time ASLR methods. This is far from sufficient to defend against new ROP attacks. In this paper, we propose Chaos, a fine-grained runtime architecture-independent ASLR for the kernel module. Chaos adopts function granularity randomization to increase randomization entropy. It continuously performs randomization during runtime to invalidate memory disclosure. To reduce overhead, Chaos only suspends the kernel module and minimizes the running state migration efforts. We implement Chaos based on Linux 5.10 LTS on ARM64 and evaluate it using two common benchmarks. The result demonstrates that Chaos achieves fine-grained runtime ASLR for protecting kernel modules with 5% performance overhead degradation at most.