DBG-310 · Debugging & Tracing · Advanced
Memory Corruption: KASAN & KFENCE — full syllabus
Finding use-after-free, out-of-bounds and uninitialised memory before they become a security advisory.
Who this course is for
Kernel and driver engineers who want use-after-free, out-of-bounds and uninitialised-memory bugs caught by tooling in development and production — before they become a corruption report or a security advisory.
Prerequisites
- Kernel module development experience
- Solid C (pointers, allocators, object lifetimes)
- Ability to build and boot custom kernels
Course outline
Day 1 — KASAN
- What KASAN instruments and how shadow memory encodes object state
- Generic vs software-tag vs hardware-tag modes: coverage vs cost
- Enabling KASAN and pointing a test workload at a suspect driver
- Interpreting a KASAN report: access, allocation and free stacks, shadow bytes
- Use-after-free and out-of-bounds signatures side by side
Day 2 — Production and fallback detection
- KFENCE: low-overhead sampling detection designed for production
- KFENCE configuration: sampling rate, pool size and what it can and cannot catch
- KMSAN and uninitialised-memory tracking: the bug class nothing else sees
- Slab debugging, poisoning and redzones on kernels where sanitizers are not an option
- Choosing the detector per environment: development, CI, staging, production
Day 3 — From catch to regression
- Fault injection for memory paths: allocation failure and corruption injection
- Building a regression harness around a fixed bug
- Integrating sanitizer runs into a test pipeline without drowning in noise
- Triage discipline: deduplicating reports and ranking by exploitability-adjacent severity
- Workshop: three injected bugs taken from report to fix to regression test
Hands-on labs
- Lab: enable KASAN on a test kernel, run a corrupted module, and interpret the full report to its allocation and free stacks
- Lab: compare KASAN modes on one workload and measure the memory and CPU cost of each
- Lab: deploy KFENCE at a production-safe sampling rate and catch a latent bug a stress run surfaces
- Lab: use slab poisoning and redzones to catch corruption on a kernel where KASAN is not available
- Lab: wire a fault-injection point into a driver path and build a regression test around the bug you fixed
Capstone project
Design a memory-corruption defence-in-depth plan for a provided driver codebase: KASAN for development, a KFENCE policy for production, slab debugging as the fallback, and a fault-injection-backed regression harness. You demonstrate the plan by catching three injected bugs — use-after-free, out-of-bounds and uninitialised use — and deliver the sanitizer reports, the fixes and the harness for each.
What you leave with
- KASAN deployment and full report interpretation
- KASAN mode selection with measured costs
- KFENCE production configuration and its known limits
- Slab debugging and poisoning technique for constrained kernels
- A regression-harness pattern that keeps fixed corruption from returning
Upcoming dates
| Dates | Where | Seats | Early bird | Regular | |
|---|---|---|---|---|---|
| 1 Nov – 3 Nov 20263 full days | RiyadhIn person · KAFD Conference Centre | 7 of 14 | — | SAR 9,000 | |
| 8 Nov – 10 Nov 20263 full days | Kuwait CityIn person · Al Hamra Tower | 12 of 14 | KWD 670until 9 Oct | ||
| 15 Nov – 17 Nov 20263 full days | MuscatIn person · Knowledge Oasis Muscat | 7 of 14 | OMR 830until 16 Oct | ||
| 15 Nov – 22 Nov 20266 half-days | Gulf bandLive online · 09:00–13:00 GMT+3 | 17 of 20 | US$1,580until 16 Oct | ||
| 16 Nov – 18 Nov 20263 full days | OttawaIn person · Kanata North Tech Park | 12 of 14 | CAD 2,930until 17 Oct | ||
| 23 Nov – 25 Nov 20263 full days | TorontoIn person · MaRS Discovery District | 7 of 14 | CAD 2,930until 24 Oct | ||
| 23 Nov – 30 Nov 20266 half-days | Europe bandLive online · 09:00–13:00 CET | 6 of 20 | US$1,580until 24 Oct | ||
| 30 Nov – 2 Dec 20263 full days | LondonIn person · Shoreditch Works | 12 of 14 | GBP 1,680until 31 Oct | ||
| 30 Nov – 7 Dec 20266 half-days | Americas bandLive online · 13:00–17:00 ET | 11 of 20 | US$1,580until 31 Oct | ||
| 7 Dec – 9 Dec 20263 full days | BerlinIn person · Factory Görlitzer Park | 7 of 14 | EUR 1,990until 7 Nov |
Book a seat, or bring this course to your team
Seats can be reserved online; private delivery runs on-site or live online, adapted to your stack.
Questions about fit or prerequisites? Email hello@kernelsystems.academy. To save this syllabus, print this page to PDF from your browser.