Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of scanning through the page cache, finding /etc/shadow or equivalent, and cracking the passwords. For concreteness, say it's a Linux kernel running on x86-64, but I would be interested in methods that would work on other kernels/hardware as well. References to papers describing techniques or existing exploit code would be much appreciated.

share|improve this question
Why are you ignoring what you call "trivial" methods? They get the job done, which is all that matters. I don't see why you reject them, nor why you dismiss them as "trivial". (If you have a good reason for rejecting them, then you need to explain and justify the actual constraints you are under, for us to give you a useful answer.) – D.W. Jul 21 '11 at 18:40
Perhaps because /etc/shadow passwords may be too difficult to crack, and because the system may never have a password entered interactively? – forest Apr 7 at 4:05
  1. You can do keylogging and learn people's passwords, SSH passphrases, etc.

  2. You may be able to access filesystem buffers or process memory and learn SSH private keys, SSL private keys, etc.

  3. You can access the internal pool for /dev/random and /dev/urandom, which may allow you to break crypto used by programs on the system.

  4. You can access any crypto keys stored and used internally by the kernel.

  5. You can defeat ASLR, which might make exploiting other vulnerabilities easier.

There may well be many more.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.