linux-kernel-defence-map.dot

//
// Linux Kernel Defence Map showing the relationships between:
//  - Vulnerability classes
//  - Exploitation techniques
//  - Bug detection mechanisms
//  - Defence technologies
//
// Author: Alexander Popov <alex.popov@linux.com>
//
// License terms: GNU General Public License (GPL), version 3.0.
// For details see LICENSE file.
//
// N.B. The node connections don't mean "full mitigation". These connections
// represent some kind of relation. So ideally, this map should help to navigate
// in documentation and Linux kernel sources.
//
// It is written in DOT language.
// How to generate svg:
//    dot -Tsvg linux-kernel-defence-map.dot -o linux-kernel-defence-map.svg
//
// References:
//
//  - The State of Kernel Self Protection by Kees Cook
//     https://outflux.net/slides/2018/lca/kspp.pdf
//
//  - grsecurity features
//     https://grsecurity.net/features.php
//
//  - Linux kernel security documentation:
//     https://www.kernel.org/doc/html/latest/security/self-protection.html
//
//  - Linux kernel mitigation checklist by Shawn C
//     https://github.com/hardenedlinux/grsecurity-101-tutorials/blob/master/kernel_mitigation.md
//

digraph {
  labelloc=top;
  fontsize=30;
  fontname=monospace;
  label="Linux Kernel Defence Map";
  compound=true;
  nodesep=0.8;
  splines=line;

  rankdir=LR;
  node [style=filled, fontname=monospace, margin="0.22,0.055"];

  subgraph cluster_legend {
    fontsize=25;
    label="Legend:";
    margin=35;

    "Mainline Defences" [shape=oval, color=palegreen3];
    "Out-of-tree Defences" [shape=oval, color=cornflowerblue];
    "Commercial Defences" [shape=oval, color=lightgrey];
    "HW Defences" [shape=oval, color=aquamarine];
    "Generic Defence Techniques" [shape=oval, color=black, style=solid];
    "Bug Detection" [shape=octagon, color=mediumpurple];
    "Vulnerabilities" [shape=box, color=pink];
    "Exploitation Techniques" [shape=box, color=gold];
  }

  // For pretty legend layout:
  edge [arrowhead=none, style=invis];
  "Mainline Defences":e -> "Out-of-tree Defences";
  "Out-of-tree Defences":e -> "Commercial Defences";
  "Commercial Defences":e -> "HW Defences";
  "Generic Defence Techniques":e -> "Bug Detection";
  "Bug Detection":e -> "Vulnerabilities";
  "Vulnerabilities":e -> "Exploitation Techniques";


  // Defences
  {
    rank=same;

    // Mainline Defences
    node [shape=oval, color=palegreen3, style=filled];
    "STACKPROTECTOR";
    "FORTIFY_SOURCE";
    "DEBUG_{LIST,SG,CREDENTIALS,NOTIFIERS,VIRTUAL}";
    "SLAB_FREELIST_RANDOM";
    "SHUFFLE_PAGE_ALLOCATOR";
    "STRICT_{KERNEL,MODULE}_RWX";
    "DEBUG_WX";
    "ARM: RODATA_FULL_DEFAULT_ENABLED";
    "BUG_ON_DATA_CORRUPTION";
    "MODULE_SIG*";
    "SECURITY_LOADPIN";
    "bpf_jit_harden";
    "DEFAULT_MMAP_MIN_ADDR=65536";
    "SCHED_STACK_END_CHECK";
    "TIF_FSCHECK flag";
    "slab_nomerge"; // similar to disabled SLAB_MERGE_DEFAULT
    "slub_debug=F"; // sanity checks
    "slub_debug=Z"; // red zoning
    "LOCKDOWN_LSM";
    "unprivileged_userfaultfd=0";
    "LDISC_AUTOLOAD is not set";

    // Mainline Defences against Transient Execution Attacks
    "X86: mds=full,nosmt";
    "X86: l1tf=full,force";
    "X86: MICROCODE";

    // Out-of-tree Defences
    node [shape=oval, color=cornflowerblue];
    "XPFO";
    "PROTECTABLE_MEMORY";
    "request_module_cap()";
    "LKRG";

    // Commercial Defences
    node [shape=oval, color=lightgrey];
    "GRKERNSEC_KSTACKOVERFLOW";
    "PAX_REFCOUNT";
    "PAX_SIZE_OVERFLOW";
    "PAX_USERCOPY";
    "PAX_KERNEXEC";
    "GRKERNSEC_JIT_HARDEN";
    "PAX_MEMORY_STACKLEAK";
    "GRKERNSEC_MODHARDEN";
    grsecurity_hardened_usermodehelper [label="by default in grsecurity"];

    // HW Defences
    node [shape=oval, color=aquamarine];
    "SMEP/PXN";
  }

  subgraph cluster_pti {
    label="";
    rank=same;
    margin=15;
    node [shape=oval, color=palegreen3]; // Mainline Defences
    "X86: pti=on (PAGE_TABLE_ISOLATION)";
    "ARM: kpti=on (UNMAP_KERNEL_AT_EL0)";
  }

  subgraph cluster_smap_pan_uderef {
    label="";
    rank=same;
    margin=15;
    "SMAP/PAN" [shape=oval, color=aquamarine]; // HW Defence
    "PAX_UDEREF" [shape=oval, color=lightgrey]; // Commercial Defence
  }

  subgraph cluster_cfi {
    label="";
    rank=same;
    margin=15;
    "PAX_RAP" [shape=oval, color=lightgrey]; // Commercial Defence
    "Clang CFI" [shape=oval, color=cornflowerblue]; // Out-of-tree Defence
  }

  subgraph cluster_ro {
    label="";
    rank=same;
    style="dashed";
    margin=15;
    // Commercial Defences
    node [shape=oval, color=lightgrey];
    "__read_only";
    "PAX_CONSTIFY_PLUGIN";
  }

  subgraph cluster_v1_mitigations {
    label="";
    rank=same;
    margin=15;
    "Respectre" [shape=oval, color=lightgrey]; // Commercial Defence
    "Manual *_nospec() usage" [shape=oval, color=palegreen3]; // Mainline Defence
  }

  subgraph cluster_v2_mitigations {
    label="";
    rank=same;
    margin=15;
    node [shape=oval, color=palegreen3]; // Mainline Defence
    "X86: spectre_v2=on (RETPOLINE)";
    "ARM: HARDEN_BRANCH_PREDICTOR";
  }

  subgraph cluster_ssb_mitigations {
    label="";
    rank=same;
    margin=15;
    node [shape=oval, color=palegreen3]; // Mainline Defence
    "X86: spec_store_bypass_disable=on";
    "ARM: ssbd=force-on";
  }

  subgraph cluster_layout_randomization {
    label="Layout Randomization";
    rank=same;
    fontsize=18;
    style="dashed";
    margin=15;
    "RANDOMIZE_{BASE,MEMORY}" [shape=oval, color=palegreen3]; // Mainline Defence
    "GRKERNSEC_RANDSTRUCT" [shape=oval, color=lightgrey]; // Commercial Defence
    "PAX_RANDKSTACK" [shape=oval, color=lightgrey]; // Commercial Defence
    "PAX_LATENT_ENTROPY" [shape=oval, color=lightgrey]; // Commercial Defence
  }

  subgraph cluster_info_exposure_mitigations {
    label="";
    rank=same;
    style="dashed";
    margin=15;
    "X86: X86_INTEL_UMIP" [shape=oval, color=palegreen3]; // Mainline Defence
    "ARM: HARDEN_EL2_VECTORS" [shape=oval, color=palegreen3]; // Mainline Defence
    "kptr_restrict" [shape=oval, color=palegreen3]; // Mainline Defence
    "GRKERNSEC_HIDESYM" [shape=oval, color=lightgrey]; // Commercial Defence
    "GRKERNSEC_DMESG" [shape=oval, color=lightgrey]; // Commercial Defence
  }

  subgraph cluster_freelist_hardening {
    label="";
    rank=same;
    style="invis";
    margin=15;
    "SLAB_FREELIST_HARDENED" [shape=oval, color=palegreen3]; // Mainline Defence
    grsecurity_hardened_freelist [label="by default in grsecurity", shape=oval, color=lightgrey]; // Commercial Defence
  }

  subgraph cluster_stack_init {
    label="";
    rank=same;
    style="dashed";
    margin=25;
    "INIT_STACK_ALL" [shape=oval, color=palegreen3]; // Mainline Defence
    "PAX_MEMORY_STRUCTLEAK" [shape=oval, color=lightgrey]; // Commercial Defence
  }

  subgraph cluster_heap_erasing {
    label="";
    rank=same;
    style="dashed";
    margin=25;
    "Heap free() Poisoning" [shape=oval, color=black, style=solid]; // Generic Defence Technique
    "init_on_alloc" [shape=oval, color=palegreen3]; // Mainline Defence
  }

  // Defences: child nodes
  {
    rank=same;

    // Mainline Defences
    node [shape=oval, color=palegreen3];
    "REFCOUNT_FULL";
    "HARDENED_USERCOPY";
    "PAGE_POISONING";
    "VMAP_STACK";
    "THREAD_INFO_IN_TASK";
    "RANDSTRUCT";
    "STRUCTLEAK_BYREF_ALL";
    "LATENT_ENTROPY";
    "__ro_after_init";
    "SECURITY_DMESG_RESTRICT";
    "ARM: CPU_SW_DOMAIN_PAN";
    "ARM: ARM64_SW_TTBR0_PAN";
    "STATIC_USERMODEHELPER";
    "slub_debug=P"; // object and padding poisoning
    "init_on_free";
    "STACKLEAK";
    "ARM: STACKPROTECTOR_PER_TASK";

    // Out-of-tree Defences
    node [shape=oval, color=cornflowerblue];
    "RANDOMIZE_KSTACK_OFFSET_DEFAULT";

    // Commercial Defences
    node [shape=oval, color=lightgrey];
    "PAX_MEMORY_SANITIZE";
  }

  // Defences relations
  edge [style=dotted, arrowhead=none, dir=none, headport=_, tailport=_];
  "REFCOUNT_FULL":e -> "PAX_REFCOUNT";
  "HARDENED_USERCOPY":e -> "PAX_USERCOPY";
  "PAGE_POISONING" -> "PAX_MEMORY_SANITIZE";
  "VMAP_STACK":e -> "GRKERNSEC_KSTACKOVERFLOW":w;
  "THREAD_INFO_IN_TASK":e -> "GRKERNSEC_KSTACKOVERFLOW":w;
  "RANDSTRUCT":e -> "GRKERNSEC_RANDSTRUCT";
  "STRUCTLEAK_BYREF_ALL":e -> "PAX_MEMORY_STRUCTLEAK":w;
  "LATENT_ENTROPY":e -> "PAX_LATENT_ENTROPY";
  "__ro_after_init":e -> "__read_only";
  "SECURITY_DMESG_RESTRICT":e -> "GRKERNSEC_DMESG";
  "STACKLEAK":e -> "PAX_MEMORY_STACKLEAK";
  "ARM: CPU_SW_DOMAIN_PAN":e -> "SMAP/PAN":w;
  "ARM: ARM64_SW_TTBR0_PAN":e -> "SMAP/PAN":w;
  "STATIC_USERMODEHELPER":e -> grsecurity_hardened_usermodehelper;
  "SLAB_FREELIST_HARDENED" -> grsecurity_hardened_freelist [constraint=false];
  "PAX_MEMORY_SANITIZE":e -> "Heap free() Poisoning":w [style=filled];
  "slub_debug=P":e -> "Heap free() Poisoning":w [style=filled];
  "init_on_free" -> "Heap free() Poisoning":w [style=filled];
  "ARM: STACKPROTECTOR_PER_TASK":e -> "STACKPROTECTOR";
  "RANDOMIZE_KSTACK_OFFSET_DEFAULT":e -> "PAX_RANDKSTACK";


  // Vulnerabilities and Exploitation Techniques
  {
    rank=same;

    // Vulnerabilities
    node [shape=box, color=pink];
    "Stack Depth Overflow (CWE-674,?)" [URL="https://cwe.mitre.org/data/definitions/674.html"];
    "Stack Buffer Overflow (CWE-121)" [URL="https://cwe.mitre.org/data/definitions/121.html"];
    "Heap Out-of-Bounds Access (CWE-122,119)" [URL="https://cwe.mitre.org/data/definitions/122.html"];
    "Int Overflow/Underflow (CWE-190/191)" [URL="https://cwe.mitre.org/data/definitions/190.html"];
    "Use-After-Free (CWE-416)" [URL="https://cwe.mitre.org/data/definitions/416.html"];
    "Double Free (CWE-415)" [URL="https://cwe.mitre.org/data/definitions/415.html"];
    "Race Condition (CWE-362)" [URL="https://cwe.mitre.org/data/definitions/362.html"];
    "Undefined Behaviour (CWE-758)" [URL="https://cwe.mitre.org/data/definitions/758.html"];
    "Type Confusion (CWE-843)" [URL="https://cwe.mitre.org/data/definitions/843.html"];
    "Double Fetch (CWE-415)" [URL="https://cwe.mitre.org/data/definitions/415.html"];
    "Memory Leak (CWE-401)" [URL="https://cwe.mitre.org/data/definitions/401.html"];

    // Exploitation Techniques
    node [shape=box, color=gold];
    "Metadata Corruption";
    "Allocator Data Corruption";
    "Heap Layout Control";
    "Finding Kernel Objects";
    "JIT Abuse";
    "WX Area Abuse";
    "Changing Kernel Image";
    "Bad Module Loading";
    "Unbalanced set_fs()";
    "Function Pointer Overwrite";
  }

  subgraph cluster_userspace_access {
    label="";
    rank=same;
    style="dashed";
    margin=25;

    // Vulnerability
    "NULL Pointer Dereference (CWE-476)" [shape=box, color=pink, URL="https://cwe.mitre.org/data/definitions/476.html"];

    // Exploitation Technique
    "Userspace Data Access" [shape=box, color=gold];
  }

  subgraph cluster_control_flow_hijack {
    label="  Control Flow Hijack Techniques  ";
    fontsize=18;
    rank=same;
    style="dashed";
    margin=25;
    node [shape=box, color=gold]; // Exploitation Techniques
    "ROP";
    "ret2usr + ROP";
    "ret2dir + ROP";
    "ret2usr";
    "ret2dir";
  }

  subgraph cluster_info_exposures {
    label="";
    rank=same;
    style="dashed";
    margin=25;
    node [shape=box, color=pink]; // Vulnerabilities
    "Info Exposure (CWE-200)" [URL="https://cwe.mitre.org/data/definitions/200.html"];
    "Uninitialized Vars (CWE-457)" [URL="https://cwe.mitre.org/data/definitions/457.html"];
  }

  subgraph cluster_hang {
    label="";
    rank=same;
    style="invis";
    margin=25;
    node [shape=box, color=pink]; // Vulnerabilities
    "Deadlock (CWE-833)" [URL="https://cwe.mitre.org/data/definitions/833.html"];
    "Infinite Loop (CWE-835)" [URL="https://cwe.mitre.org/data/definitions/835.html"];
  }

  subgraph cluster_transient_execution_vulnerabilities {
    label="Transient Execution Vulnerabilities \n (Covert Channels, CWE-514)";
    URL="https://cwe.mitre.org/data/definitions/514.html";
    rank=same;
    fontsize=18;
    margin=25;
    node [shape=box, color=pink];

    subgraph cluster_v1 {
      label="";
      margin=25;
      "Spectre v1 / BCB / CVE-2017-5753";
      "Spectre v1.1 / BCBS / CVE-2018-3693";
      "Spectre v1.2 / RPB";
    }
    subgraph cluster_v2 {
      label="";
      margin=25;
      "Spectre v2 / BTI / CVE-2017-5715";
      "Spectre RSB / CVE-2018-15572";
    }
    subgraph cluster_v3 {
      label="";
      margin=25;
      "Spectre v3 / RDCL / CVE-2017-5754 / Meltdown";
      "Spectre v3a / RSRE / CVE-2018-3640";
    }
    "Spectre v4 / SSB / CVE-2018-3639";
    "L1TF / CVE-2018-3646 / Foreshadow-VMM";
    subgraph cluster_mds {
      label="MDS";
      margin=25;
      "MFBDS / CVE-2018-12130 / RIDL / ZombieLoad";
      "MSBDS / CVE-2018-12126 / Fallout";
      "MLPDS / CVE-2018-12127";
      "MDSUM / CVE-2019-11091";
      "TAA / CVE-2019-11135";
      "L1DES / CVE-2020-0549 / CacheOut";
      "VRS / CVE-2020-0548";
    }
  }


  // Bug Detection Mechanisms
  {
    rank=same;
    node [shape=octagon, color=mediumpurple];
    "KASAN";
    "UBSAN";
    "KMSAN";
    "KTSAN";
    "KCSAN";
    "KMEMLEAK";
    "PROVE_LOCKING";
    "DEBUG_ATOMIC_SLEEP";
    "LOCKUP_DETECTOR";
    "WQ_WATCHDOG";
  }

  // Relations: Bug Detection Mechanisms vs Vulnerabilities
  edge [style=solid, arrowhead=normal, dir=back, headport=_, tailport=_];
  "Stack Buffer Overflow (CWE-121)":e -> "KASAN";
  "Heap Out-of-Bounds Access (CWE-122,119)":e -> "KASAN";
  "Use-After-Free (CWE-416)":e -> "KASAN";
  "Double Free (CWE-415)":e -> "KASAN";
  "Undefined Behaviour (CWE-758)":e -> "UBSAN";
  "Int Overflow/Underflow (CWE-190/191)":e -> "UBSAN";
  "Uninitialized Vars (CWE-457)":e -> "KMSAN" [ltail=cluster_info_exposures];
  "Race Condition (CWE-362)":e -> "KTSAN";
  "Race Condition (CWE-362)":e -> "KCSAN";
  "Memory Leak (CWE-401)":e -> "KMEMLEAK";
  "Deadlock (CWE-833)" -> "PROVE_LOCKING":w;
  "Deadlock (CWE-833)" -> "DEBUG_ATOMIC_SLEEP":w;
  "Infinite Loop (CWE-835)" -> "LOCKUP_DETECTOR":w;
  "Infinite Loop (CWE-835)" -> "WQ_WATCHDOG":w;


  // Relations: Defences vs Vulnerabilities and Exploitation Techniques
  edge [style=solid, arrowhead=normal, dir=forward, headport=_, tailport=_];
  "GRKERNSEC_KSTACKOVERFLOW":e -> "Stack Depth Overflow (CWE-674,?)";
  "PAX_MEMORY_STACKLEAK":e -> "Stack Depth Overflow (CWE-674,?)";
  "SCHED_STACK_END_CHECK":e -> "Stack Depth Overflow (CWE-674,?)";
  "PAX_USERCOPY":e -> "Stack Depth Overflow (CWE-674,?)";

  "STACKPROTECTOR":e -> "Stack Buffer Overflow (CWE-121)";
  "FORTIFY_SOURCE":e -> "Stack Buffer Overflow (CWE-121)";

  "PAX_USERCOPY":e -> "Heap Out-of-Bounds Access (CWE-122,119)";
  "slub_debug=Z":e -> "Heap Out-of-Bounds Access (CWE-122,119)";
  "FORTIFY_SOURCE":e -> "Heap Out-of-Bounds Access (CWE-122,119)";

  "PAX_REFCOUNT":e -> "Int Overflow/Underflow (CWE-190/191)";
  "PAX_SIZE_OVERFLOW":e -> "Int Overflow/Underflow (CWE-190/191)";

  "PAX_MEMORY_STACKLEAK":e -> "Uninitialized Vars (CWE-457)" [lhead=cluster_info_exposures];
  "PAX_MEMORY_STRUCTLEAK":e -> "Uninitialized Vars (CWE-457)" [ltail=cluster_stack_init, lhead=cluster_info_exposures];
  "Heap free() Poisoning":s -> "Uninitialized Vars (CWE-457)" [ltail=cluster_heap_erasing, lhead=cluster_info_exposures];

  "Heap free() Poisoning":s -> "Use-After-Free (CWE-416)" [ltail=cluster_heap_erasing];

  "slub_debug=F":e -> "Double Free (CWE-415)";
  "SLAB_FREELIST_HARDENED":e -> "Double Free (CWE-415)";

  "kptr_restrict":e -> "Info Exposure (CWE-200)":w [ltail=cluster_info_exposure_mitigations];

  "DEBUG_{LIST,SG,CREDENTIALS,NOTIFIERS,VIRTUAL}":e -> "Metadata Corruption";
  "BUG_ON_DATA_CORRUPTION":e -> "Metadata Corruption";
  "PROTECTABLE_MEMORY":e -> "Metadata Corruption";
  grsecurity_hardened_usermodehelper:e -> "Metadata Corruption";
  "LKRG":e -> "Metadata Corruption";

  "slub_debug=F":e -> "Allocator Data Corruption";
  grsecurity_hardened_freelist:e -> "Allocator Data Corruption";
  "SLAB_FREELIST_HARDENED":e -> "Allocator Data Corruption";

  "__read_only":e -> "Function Pointer Overwrite" [ltail=cluster_ro];

  "SLAB_FREELIST_RANDOM":e -> "Heap Layout Control";
  "slab_nomerge":e -> "Heap Layout Control";
  "SHUFFLE_PAGE_ALLOCATOR":e -> "Heap Layout Control";
  "unprivileged_userfaultfd=0":e -> "Heap Layout Control";

  "PAX_RAP":s -> "ROP" [ltail=cluster_cfi];

  "PAX_KERNEXEC":e -> "ret2usr":w;
  "X86: pti=on (PAGE_TABLE_ISOLATION)":e -> "ret2usr":w [ltail=cluster_pti];
  "SMEP/PXN":e -> "ret2usr":w;
  "SMAP/PAN":s -> "ret2usr":w [ltail=cluster_smap_pan_uderef];

  "SMAP/PAN":s -> "Userspace Data Access":s [ltail=cluster_smap_pan_uderef, lhead=cluster_userspace_access];

  "DEFAULT_MMAP_MIN_ADDR=65536":e -> "NULL Pointer Dereference (CWE-476)":w;

  "SMAP/PAN":s -> "ret2usr + ROP" [ltail=cluster_smap_pan_uderef];
  "PAX_RAP":s -> "ret2usr + ROP" [ltail=cluster_cfi];

  "PAX_KERNEXEC":e -> "ret2dir";
  "XPFO":e -> "ret2dir";

  "XPFO":e -> "ret2dir + ROP";
  "PAX_RAP":s -> "ret2dir + ROP" [ltail=cluster_cfi];

  "PAX_RANDKSTACK":e -> "Finding Kernel Objects" [ltail=cluster_layout_randomization];

  "GRKERNSEC_JIT_HARDEN":e -> "JIT Abuse";
  "bpf_jit_harden":e -> "JIT Abuse";

  "PAX_KERNEXEC":e -> "WX Area Abuse";
  "STRICT_{KERNEL,MODULE}_RWX":e -> "WX Area Abuse";
  "DEBUG_WX":e -> "WX Area Abuse";
  "ARM: RODATA_FULL_DEFAULT_ENABLED":e -> "WX Area Abuse";

  "LOCKDOWN_LSM":e -> "Changing Kernel Image";
  "LKRG":e -> "Changing Kernel Image";

  "GRKERNSEC_MODHARDEN":e -> "Bad Module Loading";
  "MODULE_SIG*":e -> "Bad Module Loading";
  "SECURITY_LOADPIN":e -> "Bad Module Loading";
  "request_module_cap()":e -> "Bad Module Loading";
  "LDISC_AUTOLOAD is not set":e -> "Bad Module Loading";

  "TIF_FSCHECK flag":e -> "Unbalanced set_fs()";

  "X86: MICROCODE":e -> "Spectre v1 / BCB / CVE-2017-5753" [lhead=cluster_transient_execution_vulnerabilities]
  "Respectre":e -> "Spectre v1 / BCB / CVE-2017-5753" [ltail=cluster_v1_mitigations, lhead=cluster_v1];
  "X86: spectre_v2=on (RETPOLINE)":e -> "Spectre v2 / BTI / CVE-2017-5715" [ltail=cluster_v2_mitigations, lhead=cluster_v2];
  "X86: pti=on (PAGE_TABLE_ISOLATION)":e -> "Spectre v3 / RDCL / CVE-2017-5754 / Meltdown" [ltail=cluster_pti, lhead=cluster_v3];
  "X86: spec_store_bypass_disable=on":e -> "Spectre v4 / SSB / CVE-2018-3639" [ltail=cluster_ssb_mitigations];
  "X86: l1tf=full,force":e -> "L1TF / CVE-2018-3646 / Foreshadow-VMM":w;
  "X86: l1tf=full,force":e -> "L1DES / CVE-2020-0549 / CacheOut":w;
  "X86: mds=full,nosmt":e -> "MSBDS / CVE-2018-12126 / Fallout" [lhead=cluster_mds];
}