一句话：提出 kMVX，通过同时运行多个多样化内核变体并检测分歧，防御内核信息泄露漏洞。
内核信息泄露漏洞可泄露密钥或内核指针等敏感信息，对生产系统构成严重威胁。现有针对 Linux 等内核的防御在覆盖范围或性能开销上存在不足。本文提出 kMVX，一种通过在同一机器上同时运行多个多样化内核变体来综合防御内核信息泄露的方案。其设计确保这些变体仅在攻击者试图利用内核漏洞时才出现分歧，通过检测分歧来阻止信息泄露。传统多版本执行（MVX）因运行时环境假设难以用于内核，而 kMVX 可应用于商品化内核。基于 Linux 的原型表明，kMVX 能提供强大的信息泄露防护，最坏情况下对流行服务器应用仅带来 20–50% 性能开销。
Kernel information leak vulnerabilities are a major security threat to production systems. Attackers can exploit them to leak confidential information such as cryptographic keys or kernel pointers. Despite efforts by kernel developers and researchers, existing defenses for kernels such as Linux are limited in scope or incur a prohibitive performance overhead. In this paper, we present kMVX, a comprehensive defense against information leak vulnerabilities in the kernel by running multiple diversified kernel variants simultaneously on the same machine. By constructing these variants in a careful manner, we can ensure they only show divergences when an attacker tries to exploit bugs present in the kernel. By detecting these divergences we can prevent kernel information leaks. Our kMVX design is inspired by multi-variant execution (MVX). Traditional MVX designs cannot be applied to kernels because of their assumptions on the run-time environment. kMVX, on the other hand, can be applied even to commodity kernels. We show our Linux-based prototype provides powerful protection against information leaks at acceptable performance overhead (20--50% in the worst case for popular server applications).