Chapter 42. Enabling kstack randomization offset to improve security

The kernel stack (kstack) randomization offset security feature randomizes the kernel stack location for each system call. This prevents attackers to exploit kernel vulnerabilities.

Unlike other architectures that rely on cycle counters for kstack randomization, a method that can be unreliable, 64-bit ARM (aarch64) uses the kernel’s random number generator (RNG). This approach is preferred for several reasons:

While the kernel RNG is generally a robust solution, it can introduce significant latency spikes, particularly for real-time (RT) workloads. As a result, the kstack randomization offset feature is disabled by default in the aarch64 real-time kernel. This decision, however, includes a tradeoff: it slightly reduces kernel security.