Kernel vulnerability analysis: A survey

Abstract

Kernel vulnerability may lead to information disclosure, privilege escalation, rootkit planting, etc. Nowadays mobile devices and other smart products has been increasingly available. Modern operation systems need to support new functions like GSM, Bluetooth, Wi-Fi, GPS, Camera of the smart devices. As a result, the number and categories of vulnerabilities and attacks is dramatically increasing. Correspondingly, varieties of researches have gone into finding such vulnerabilities in kernel. The kernel vulnerability analysis methods are vastly diverse. This paper surveys the state of the art on kernel vulnerability analysis. We summarize, compare, evaluate existing methods and provide the features, strengths and weaknesses of each kind of approaches. Then we present the trend on kernel vulnerability analysis. First, analysis on the system call, file system and the driver code become increasingly important. Second, existing methods can only handle limited kinds of vulnerabilities, which is insufficient for kernels, which contains modules, drivers, core kernel etc.. Third, the method for kernel vulnerability analysis will continuously focused on restricted parts of kernels or limited types of vulnerabilities for the kernel is implemented differently according to their platforms.