Kshield: an Ebpf Runtime Defence Framework for Linux Kernel Privilege Escalation Attacks

Context: Modern Linux kernels face a critical security challenge due to the extended mitigation latency (averaging 100 days) for publicly disclosed vulnerabilities, which creates a prolonged attack window for privilege escalation. Existing defense mechanisms, including built-in security features and third-party kernel modules, are inadequate as they are often bypassed by advanced exploits, rely on historical vulnerability patterns, and require disruptive system reboots for deployment. Objective: This paper aims to design and implement a novel defense framework that overcomes the limitations of current solutions. The primary goals are to achieve technique-sensitive protection independent of specific vulnerabilities, eliminate the dependency on proof-of-concepts or kernel source code, and enable real-time deployment without system reboots. Method: We propose kShield, a lightweight runtime defense framework built on Extended Berkeley Packet Filter (eBPF) technology. Its design leverages the Compile Once-Run Everywhere (CO-RE) feature to ensure cross-kernel version compatibility. The core of our method is a vulnerability-agnostic architecture that focuses on mitigating general exploit techniques rather than patching specific vulnerabilities. The framework's effectiveness and performance were evaluated through comparative tests with the Linux Kernel Runtime Guard (LKRG). Result: The evaluation demonstrates that kShield successfully mitigates 91.3% of the tested real-world kernel exploits. In performance comparisons, kShield incurs comparable overhead to LKRG, a leading runtime guard solution, while providing significantly broader and more proactive protection against a wide range of vulnerability types. Conclusion: kShield establishes itself as a practical and generalizable solution for hardening production Linux systems. By leveraging eBPF, it provides comprehensive protection during critical vulnerability exposure windows seamlessly and without system interruptions, representing a fundamental shift from vulnerability-specific patching to technique-centric mitigation.