SLAB Freelist Hardening (Freelist Randomization and Integrity)
Description
Enable CONFIG_SLAB_FREELIST_RANDOM and CONFIG_SLAB_FREELIST_HARDENED to randomize slab allocator freelist ordering and validate freelist pointer integrity. Freelist randomization breaks the heap layout predictability that use-after-free exploits depend on: the attacker cannot predict which freed object will be returned by the next allocation of the same size, making heap spray and object replacement techniques unreliable. Freelist hardening adds XOR-based pointer mangling with a per-cache random value and the pointer address itself, detecting freelist pointer corruption that is the hallmark of heap exploitation. When a corrupted freelist pointer is detected, the kernel panics rather than following the corrupted pointer to attacker-controlled memory. Together these controls convert deterministic heap exploitation into a probabilistic attack with detection.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Freelist randomization eliminates the deterministic allocation ordering that heap exploitation depends on; the attacker must spray many objects and cannot predict which freed slot their controlled data will occupy. Freelist hardening detects pointer corruption and panics, so the attacker must also bypass integrity checks on freelist pointers — exploitation becomes probabilistic with detection rather than reliable |
CWE Relationships
Verification
Verify kernel is built with slab freelist randomization and hardening
# Expected: 2
# Expected: CONFIG_SLAB_FREELIST_HARDENED=y