Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of scanning through the page cache, finding /etc/shadow or equivalent, and cracking the passwords. For concreteness, say it's a Linux kernel running on x86-64, but I would be interested in methods that would work on other kernels/hardware as well. References to papers describing techniques or existing exploit code would be much appreciated.

share|improve this question
2  
Why are you ignoring what you call "trivial" methods? They get the job done, which is all that matters. I don't see why you reject them, nor why you dismiss them as "trivial". (If you have a good reason for rejecting them, then you need to explain and justify the actual constraints you are under, for us to give you a useful answer.) –  D.W. Jul 21 '11 at 18:40
add comment

1 Answer

  1. You can do keylogging and learn people's passwords, SSH passphrases, etc.

  2. You may be able to access filesystem buffers or process memory and learn SSH private keys, SSL private keys, etc.

  3. You can access the internal pool for /dev/random and /dev/urandom, which may allow you to break crypto used by programs on the system.

  4. You can access any crypto keys stored and used internally by the kernel.

  5. You can defeat ASLR, which might make exploiting other vulnerabilities easier.

There may well be many more.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.