See you later, allocator!': Updating Volatility's analysis of modern Linux memory allocators

Memory forensics tools such as Volatility often rely on walking kernel linked lists to enumerate processes and network sockets. That approach misses anything the kernel has freed but not yet overwritten, and it becomes unreliable on modern Linux systems, where the SLUB allocator replaced the older SLAB design and no longer keeps complete lists of slabs. The talk explains how SLUB groups objects into size-based caches and tracks only partially allocated slabs, and why that breaks traditional enumeration.

The proposed method starts from a small kernel object that has already been located through other lists. From its address and the cache size, the plugin finds the enclosing slab and steps forward and backward through memory to extract every object in it, accepting that this produces a lot of noise. The work also updates an older slab-info plugin so it handles SLUB systems. In lab tests on virtual machines, carved sockets and processes were compared against netstat and ps output, and the method recovered objects the list-based plugins missed, including a process hidden by a BPFDoor-style rootkit.

The closing discussion covered the noise problem, whether a malware sample that scrubs itself from memory would still leave traces, and the limits of the technique for user-space content such as containers. Future work includes porting the plugin to Volatility 3 and filtering the output. The main takeaway for practitioners is that carving can recover freed or concealed kernel objects when list walking fails, and that newer kernel memory representations will change future Linux memory analysis.