0

It was mentioned in this thread that kernel exploits usually use syscalls to trigger undesired behavior:

How can you detect kernel exploits?

Are there any ways or known examples which do not use syscalls? What about programs beyond the kernel?

1

A kernel exploit (or anything at all) not using syscalls will be pretty useless.

Imagine writing a module without read, write, fork, no socket functions, no memory allocation, no IO functions...

Kernel malware needs the syscalls to intercept file read and write, open sockets, create files, read and write process memory, and so on. Anything that does not read or write anything, does not do any disk or network IO, does not allocate memory and does not even get the time of day isn't really doing anything at all, let alone do something malicious.

2
  • I'm not talking about what the malware does during execution but more about how a kernel exploit can be triggered. Also I am wondering if you are at the kernel level do you need to make syscalls at all? – coronaduck Jan 25 at 19:10
  • yes, you need syscalls. Syscalls are nothing but functions executed by the kernel. And "being in kernel space" means you can call kernel function without anything stopping you. – ThoriumBR Jan 25 at 20:41
0

Yes. A remote kernel exploit could take place in the TCP/IP stack which runs in the kernel (for Linux). A vulnerability in the TCP/IP stack could lead to kernel exploitation without any syscalls being invoked.

2
  • TCP is handled by a syscall... – ThoriumBR Jan 26 at 13:02
  • The implementation of the protocol by the kernel is not handled by a syscall. The networking code which parses a TCP header is not done by a syscall. This is assuming syscall is defined as the interface between userspace and kernelspace. – returneax Jan 27 at 2:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.