KOOBE-Guard: Active Temporal Mitigation of Kernel Double-Free Vulnerabilities

Authors: Vedant Karande & Kiran Kumari
Course: Network & Systems Security (SIL7165) - Indian Institute of Technology Delhi

Overview

KOOBE-Guard is a dynamic Intrusion Prevention System (IPS) developed as a Linux Loadable Kernel Module (LKM) to actively mitigate catastrophic heap-based vulnerabilities, specifically targeting the CVE-2024-1086 double-free vulnerability[cite: 1].

Modern operating systems implicitly trust that memory subsystems allocate and free memory flawlessly[cite: 1]. When complex subsystems like the Linux kernel's nf_tables contain logic errors, it can lead to memory mismanagement, allowing an unprivileged attacker to achieve Local Privilege Escalation (LPE) via Heap Feng Shui and overlapping allocations[cite: 1]. KOOBE-Guard neutralizes this by shifting from heavy, passive shadow-memory defenses to real-time Active Temporal Gap Tracking[cite: 1].

Architecture & Methodology

Traditional mitigation tools like KASAN rely on immense shadow memory mapping, introducing 200%-300% CPU overhead and catastrophic RAM bloat, rendering them unusable for production environments[cite: 1].

KOOBE-Guard intercepts the exploit using the following methodology:

• Active Temporal Gap Tracking: Kprobes are hooked directly into the kfree allocator pathway[cite: 1]. The module records the exact nanosecond timestamp of freed memory addresses[cite: 1].
• Exploit Identification: Normal system memory recycling occurs over tens of thousands of nanoseconds, whereas CVE-2024-1086 unwinds instantaneously[cite: 1]. KOOBE-Guard filters for this malicious signature utilizing a heavily optimized 5,000-nanosecond (5µs) threshold[cite: 1].
• Active Parameter Nullification: Upon detecting a temporal signature matching an exploit loop, the module forcefully rewrites the CPU registers mid-flight (regs->di = 0) to NULL[cite: 1]. This forces a safe kfree(NULL) operation, completely preventing SLUB freelist corruption[cite: 1].

Repository Structure

• defense_module/: Contains the KOOBE-Guard LKM source code and Makefiles.
• evaluation_scripts/: Bash scripts (benchmark.sh, hit_rate.sh) utilized for quantitative QEMU testing.
• docs/: Comprehensive project reports and presentation slides.
• proofs/: System architecture diagrams, execution screenshots, and benchmark graphs.
• exploit_poc/: Submodule linking to the weaponized Proof-of-Concept for CVE-2024-1086 used to trigger the vulnerability state.

Evaluation & Benchmarks

The framework was rigorously evaluated in a deeply isolated, hardware-accelerated QEMU virtual laboratory running a custom-compiled Linux 6.6.0 kernel[cite: 1].

• Hit Rate: Achieved a 100% Interception Rate per clean boot cycle, entirely neutralizing the double-free[cite: 1].
• Memory Overhead: Introduced 0% measurable RAM bloat; the system consumed 57MB of RAM both with and without the defense module active[cite: 1].
• CPU Latency: Imposed an exceptionally minimal I/O latency penalty, processing filesystem traversals in 2.25 seconds compared to a 2.01-second unprotected baseline[cite: 1].

Acknowledgments & Attribution

• Exploit Development: The original weaponized Proof-of-Concept (PoC) exploit used to evaluate the KOOBE-Guard module's defensive efficacy was authored by Notselwyn. The untouched exploit code is linked as a submodule in the exploit_poc directory. Visit the original repository here: Notselwyn/CVE-2024-1086.
• Research Basis: This work extends foundational concepts from the original KOOBE analytical tool developed by Chen et al. (USENIX 2020)[cite: 1].

License

This project is licensed under the GPL-2.0 License. See the LICENSE file for details.