Google Adds Control-Flow Integrity to Beef up Android Kernel Security

Google has added a new security feature to the latest Linux kernels for Android devices to prevent it against code reuse attacks that allow attackers to achieve arbitrary code execution by exploiting control-flow hijacking vulnerabilities.

In code reuse attacks, attackers exploit memory corruption bugs (buffer overflows, type confusion, or integer overflows) to take over code pointers stored in memory and repurpose existing code in a way that directs control flow of their choice, resulting in a malicious action.

Since Android has a lot of mitigation to prevent direct code injection into its kernel, this code reuse method is particularly popular among hackers to gain code execution with the kernel because of the huge number of function pointers it uses.

In an attempt to prevent this attack, Google has now added support for LLVM's Control Flow Integrity (CFI) to Android's kernel as a measure for detecting unusual behaviors of attackers trying to interfere or modify the control flow of a program.
Basically, Control-Flow Integrity (CFI) is a security policy that ensures software execution at run-time must follow the path of a previously determined control flow graph (CFG) by the compiler at the compile time.

"CFI attempts to mitigate these attacks by adding additional checks to confirm that the kernel's control flow stays within a precomputed graph," said Sami Tolvanen, Android Security Staff Software Engineer.

"This doesn't prevent an attacker from changing a function pointer if a bug provides write access to one, but it significantly restricts the valid call targets, which makes exploiting such a bug more difficult in practice."

The extra checks added by CFI will make sure that apps or programs with unusual behavior will be automatically aborted.

Control-Flow Integrity Added to Android Kernel 4.9 and 4.14

According to Google, Google Pixel 3 launched earlier this week is the first Android device to integrate the new kernel code protection system.

However, CFI support has now been added to Android kernel versions 4.9 and 4.14, and Google recommends all Android device vendors to enable the feature in the kernel of their new arm64 devices running Android 9 for additional protection against kernel vulnerabilities.

"LLVM's CFI protects indirect branches against attackers who manage to gain access to a function pointer stored in kernel memory," Tolvanen concluded. "This makes a common method of exploiting the kernel more difficult."

Google also plans to protect function return addresses from similar attacks by adding LLVM's Shadow Call Stack in an upcoming compiler release.