HotBPF - An On-demand and On-the-fly Memory Protection for the Linux Ker... Yueqi Chen & Zhenpeng Li

Motivation and threat window

Yueqi Chen and Zhenpeng Li present HotBPF, on-demand kernel memory protection for slab-allocated objects without recompiling or rebooting. They highlight the roughly 66-day average gap between vulnerability discovery and patch deployment when attackers can freely develop exploits.

Slab exploitation model

Use-after-free and out-of-bounds writes on slab objects let attackers corrupt adjacent victims and hijack function pointers. HotBPF isolates vulnerable objects in the non-overlapping vmalloc region so associated corruption cannot reach victims in direct-map slab memory.

Design and implementation

Challenges include pinpointing specific vulnerable structs among thousands of types without over-separating. A userspace agent parses fuzzer or static-analysis bug reports and stack traces, maps allocation sites via debug info, and loads eBPF hooks to divert vulnerable-object allocations dynamically at runtime.