According to my understanding so far:

  • a kernel-space rootkits runs in ring0 and use techniques such as syscalls

  • a user-space rootkits runs in ring3 and uses techniques such as library injections

  • rootkits are all executed with administrative privileges. Hence, an attacker would have obtain the necessary information available to run the rootkit

However, I am confused at when would one would prefer to use a kernel-space rootkit or a user-space rootkit. As a kernel-space rootkit has higher privileges why not just run a kernel-space rootkit every time?

1 Answer 1


You might not have high privileges on the system you're targeting. If you don't have ring 0 or equivalent privileges that allows you to modify the kernel (e.g. by loading custom unsigned kernel modules when supported), you might have to limit yourself to a userspace rootkit. Just because you have root doesn't mean you can get ring 0, and many secure configurations prevent root from modifying the kernel.

Another reason you might prefer a userspace rootkit is because it is less likely to crash or malfunction. A kernel rootkit will typically only work with one specific kernel version, and any update to the kernel requires adjusting the rootkit. Furthermore, a kernel rootkit is more likely to cause instability and bring the entire system down. If you don't need the powerful features a kernel rootkit can give you like syscall hooking, you might choose the option which is more stable and works on a wider variety of systems.

A well-designed userspace rootkit might work equally well on Debian Linux as on Solaris (a UNIX which has no code in common with Linux systems), but a kernel rootkit designed for Debian with kernel 4.18.6 might not even load if you try to run on CentOS, even if the kernel version is the exact same.

  • 2
    Greetings, Thank you very much for the reply! It's clear and concise, doubts have been clarified! :)
    – meoware
    May 22, 2019 at 2:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .