Kernel Hot Patching via Dynamic Instruction Relocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current kernel vulnerability hot patching solutions face challenges due to kernel fragmentation, requiring recompilation of source codes for different kernel versions, limiting their applicability and increasing resource expenditure.
Innovation Solution
A method and apparatus that collect attribute information of the to-be-repaired kernel, acquire vulnerability repairing code matching the feature information, relocate instructions, and execute the code using a patch application programming interface to adapt to different kernel functions, enabling self-adaptation across various kernel versions without requiring kernel source code modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vulnerability repairing code is compiled for each specific kernel version, then the repair code can be precisely adapted to that kernel, but the complexity of maintenance increases significantly and resources are expended repeatedly
Solution Approach 1:
The patent creates a universal vulnerability repairing code that can be applied across multiple kernel versions through version identification and adaptive selection mechanisms. The system maintains a database of kernel version information and automatically selects or generates appropriate repair code based on the detected kernel version, eliminating the need to manually compile and maintain separate repair codes for each kernel version while ensuring precise adaptation to the specific kernel being repaired.
2Reliability
If hot patching is implemented without kernel source code modification, then system reliability is enhanced, but compatibility across different kernel versions becomes difficult to ensure
Solution Approach 1:
The patent performs preliminary actions by collecting and storing kernel version information, struct definitions, and function implementations in advance before hot patching is needed. The system pre-processes compatibility data and creates a mapping between different kernel versions and their specific implementations. When hot patching is required, the system queries this pre-collected information to ensure the repair code is compatible with the target kernel version, thus maintaining both system reliability and broad compatibility without modifying kernel source codes.
3Loss of energy
If the same vulnerability repairing code is used for different kernel versions, then resource expenditure is reduced, but the code may not be compatible with all kernel variants
Solution Approach 1:
The patent implements a dynamic vulnerability repairing code generation and selection system that adapts to different kernel versions. The system dynamically queries kernel version information, compares it against stored compatibility data, and either selects an appropriate pre-generated repair code or generates a new one tailored to the specific kernel variant. This dynamic adaptation mechanism allows the system to reuse repair codes across compatible kernel versions (reducing resource expenditure) while ensuring compatibility by generating or selecting version-specific codes when necessary (maintaining reliability).
Data Source
AI summary
The present disclosure discloses a method and an apparatus for repairing a kernel vulnerability. A specific implementation of the method comprises: collecting attribute information of a to-be-repaired kernel, the attribute information comprising feature information for representing a code loading mode supported by the to-be-repaired kernel; acquiring a vulnerability repairing code matching the feature information, the vulnerability repairing code being used for invoking a patch application programming interface, the patch application programming interface being used for adapting the vulnerability repairing code to kernel functions of different kernels; loading the vulnerability repairing code and relocating an instruction contained in the vulnerability repairing code; replacing an address relocated by the patch application programming interface in the vulnerability repairing code with an address of the kernel function invoked by the vulnerability repairing code; and executing the vulnerability repairing code with the replaced address to repair the kernel vulnerability.