Questions tagged [kernel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
2 answers
114 views

Kernel level attack?

In a Unix-like system, the concept of privileged and non-privileged users is used for security, preventing numerous attacks. When a non-privileged user executes malicious code at a normal level, the ...
Student's user avatar
  • 101
0 votes
0 answers
31 views

How does IOMMU and/or Linux kernel handle DMA that span a page boundary?

I am looking into how DMA works at the device driver and kernel level in the Linux kernel. I observed that access control to DMA buffers from IO devices is performed by the IOMMU and IOMMU driver in ...
sammy17's user avatar
  • 31
1 vote
0 answers
66 views

Is having no driver installed better than having old driver?

How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates? On older PCs and laptops where some components are no ...
Shubham Deshmukh's user avatar
0 votes
0 answers
54 views

Hooking system calls for a specific process on Linux

I want to make it so that syscalls from a particular process are controlled by another process (admin or same user, doesn't really matter to me.) I realize this gives some rootkit trojan vibes, but I'...
R-Rothrock's user avatar
0 votes
0 answers
31 views

OriginalFirstThunk in memory

I understand the point of IAT/IDT/ INT and dynamically loaded DLLs at runtime. The OriginalFirstThunk in the Import Directory table refers to the function names stored (in the case of an ordinal) in ...
Pieter Jansen's user avatar
2 votes
1 answer
104 views

Linux BPFtrace - user switch from suid bit applications not detected

I want to monitor systemcalls with bpftrace (https://github.com/iovisor/bpftrace/). For most systemcalls, this works without problems, but I have problems to monitor applications, where the suid bit ...
Manfred Kaiser's user avatar
0 votes
1 answer
371 views

user namespaces: do they increase security, or introduce new attack surface?

user namespaces in Linux are presented as a security feature, which should increase security. But is this really true? Is it possible that while user namespaces fix one kind of problem, they introduce ...
Martin Vegter's user avatar
0 votes
0 answers
63 views

Can I know kernel address layout and memory mapped IO layout from the user privilege in linux kernel?

My current understanding is that the user does not have any way of knowing the kernel address space layout due to the protection mechanisms such as Kernel Address Space Layout Randomization (KASLR). ...
sammy17's user avatar
  • 31
0 votes
1 answer
66 views

Why does this method of modifying kernel memory work?

I have no experience of kernel programming or anything low level. I just watched this video and at 21:10 the presenter started to talk about modifying kernel memory using two pointers. From my ...
Nicholas Humphrey's user avatar
5 votes
1 answer
1k views

Explanation of capabilities: CAP_NET_BIND_SERVICE

I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain. I am in a VM (Kali). ❯ uname -a ...
cactuschibre's user avatar
0 votes
1 answer
221 views

Capabilities DROP in container of Kubernetes pod running with specific UID

I am doing some security research on Kubernetes and I found something still mysterious to me, concerning capabilities. Example of simple pod: apiVersion: v1 kind: Pod metadata: name: my-pod-httpd ...
cactuschibre's user avatar
1 vote
0 answers
136 views

Was the kernel I used vulnerable/deprecated?

Background Information As I developer I am running multiple (partly virtual-)machines with Debian GNU/Linux and on some of these machines I work with highly confidential documents or dangerous ...
PXLDEV's user avatar
  • 11
0 votes
1 answer
715 views

Is there a difference between a bootkit and a ring-0 rootkit?

I understand the difference between a Ring-0 rootkit and a Ring-3 rootkit, in terms of their hierarchical depth in computational models. That is kernel mode and usermode, respectively. I am confused ...
questioner's user avatar
0 votes
0 answers
493 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
Jerry_D's user avatar
2 votes
1 answer
302 views

Container escape - CVE-2022-0492 - hybrid cgroups?

I saw the recent CVE-2022-0492 that can enable container escape, and I have a decent understanding of cgroups and container capabilities, but not very familiar with how hybrid cgroup v1/v2 works, nor ...
4oo4's user avatar
  • 125
2 votes
1 answer
103 views

Security of a ro volume in Docker

What are the security implications of mapping a host folder to a Docker container ro? For example -v /usr/local/bin:/usr/local/bin:ro. Of course, the container can now read the host folder. But, ...
SRobertJames's user avatar
1 vote
1 answer
203 views

How does gVisor run its own kernel replacement under Docker for security? [closed]

I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security. My question is: The whole point ...
SRobertJames's user avatar
0 votes
0 answers
104 views

How to execute Android verified boot during first boot after updating OS in Android?

I need to execute AVB (Android verified boot) during first boot after updating Android OS. BOARD_AVB_ENABLE = true is already present in the mk file device/hikey/common/BoardConfigCommon.mk in the ...
Abracadabra's user avatar
0 votes
2 answers
460 views

How to completely restrict Steam in Linux to defend against remote zero day exploits?

My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
OneAndOnly's user avatar
1 vote
1 answer
281 views

What physical damage can a user mode windows driver do?

If a driver runs in kernel mode it obviously can manipulate everything (well everything in ring 0), so manipulating the file system or devices is a possibility. Potentially devices can be destroyed, ...
BenjaminH's user avatar
  • 552
1 vote
0 answers
236 views

How to go about checking if Windows is running any untrusted drivers (programatically)

I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
kundrata's user avatar
  • 111
1 vote
2 answers
368 views

Is Zircon kernel (from Fuchsia OS) safer by being a microkernel?

Fuchsia's possible Android replacement uses the Zircon microkernel. This means that the drivers should run in userspace. Is this an advantage over Android? For example, closed source drivers now can't ...
Rafaelo's user avatar
  • 31
10 votes
2 answers
745 views

How effective is Windows KDP for exploit mitigation in practice?

Windows Kernel Data Protection is a kernel security feature which appears to use Extended Page Tables (EPT, a hardware virtualization feature) to enforce read-only pages. How effective is this at ...
forest's user avatar
  • 66.5k
0 votes
1 answer
154 views

How to detect fileless kernel compromise in linux

Is there a way to detect fileless kernel compromise in Linux? The only one way to analyze this kind of attack is by volatility. Volatility is a very good product, but not often updated especially with ...
Lews's user avatar
  • 105
1 vote
0 answers
177 views

ctf kernel challenges does not work [closed]

I'm trying to learn and solve some 'kernel related' ctf challenges (reading writups to try to run same environment and achieve root using one of the kernel-pwn technique...). I'm using Ubuntu 20 VM ...
guesst's user avatar
  • 11
1 vote
0 answers
86 views

Can XIP (execute in place) be used for kernel protection?

Starting with kernel 5.13 RiscV will get XIP where parts of the kernel run from non volatile memory like flash. In theory you could make parts of the kernel really read only either from the hardware ...
XIP's user avatar
  • 11
0 votes
1 answer
106 views

Vulnerability in which part of the Android architecture would allow an attacker to take control of the hardware [closed]

This question is intended for better understanding of security features of Android architecture. In particular, I want to know what part of the architecture needs to be secure to prevent an attacker ...
Ritesh Singh's user avatar
2 votes
0 answers
243 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
reed's user avatar
  • 15.7k
0 votes
2 answers
471 views

Does a (kernel) exploit always need to use system calls?

It was mentioned in this thread that kernel exploits usually use syscalls to trigger undesired behavior: How can you detect kernel exploits? Are there any ways or known examples which do not use ...
coronaduck's user avatar
1 vote
1 answer
715 views

Vulnerabilities for multiple kernel versions that are installed on a given server

As per Exclude or display vulnerabilities for non-running Linux kernels : It is possible to have multiple kernels detected on a single Linux host and Qualys will report all vulnerabilities found on ...
cyzczy's user avatar
  • 1,558
2 votes
2 answers
183 views

Is it possible to determinate which functions a kernel module calls?

Trusting kernel drivers is bad. Is there something we can do to have at least an idea about what it does? For example, let's suppose an armv8a linux kernel. I'd search for all the syscalls, which ...
Gatonito's user avatar
  • 121
2 votes
1 answer
1k views

What are the dangers of a firmware malware in 2021 and is it possible?

I was reading a few articles online about how some firmware can be altered into malware and essentially infect a hardware equipment for its entire life time. Like almost all SSDs in the industry ...
JackBixuis's user avatar
0 votes
1 answer
430 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
asd40732's user avatar
0 votes
1 answer
434 views

How to get information about segments of physical memory not described in System.map on linux

When I do in linux root shell cat /boot/System.map-$(uname -r) it returns me segments of memory but there is a big gap around phys_startup_64: 00000000000228c0 D softnet_data 0000000000022a80 d ...
nusch's user avatar
  • 47
2 votes
1 answer
156 views

Can a host OS be attacked through the network stack?

Forenote: I'm not familiar with how virtualisation works on a low-level (but I'd certainly like to learn) so this question could arise from ignorance. Example Scenario: One virtualised router is ...
Synthetic Ascension's user avatar
2 votes
1 answer
519 views

Linux security modules (LSM) and reference monitor implementation

as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision. Furthermore, I think the Linux ...
urandom's user avatar
  • 171
0 votes
1 answer
632 views

How do you adjust offest and kernel stack size from an exploit?

Needless to I say I have no idea how to do this. I'm performing a pentest and I found an exploit related the box : https://www.exploit-db.com/exploits/44298 In the exploit comments, the author said : ...
steven miller's user avatar
0 votes
2 answers
175 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
Jason's user avatar
  • 3,096
0 votes
1 answer
590 views

AES-256 ESSIV in dm-crypt

I am playing around with disk encryption. https://gitlab.com/cryptsetup/cryptsetup/-/wikis/DMCrypt#iv-generators says: essiv: "encrypted sector|salt initial vector", the sector number is encrypted ...
wtdmn's user avatar
  • 3
0 votes
1 answer
979 views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
user148614's user avatar
1 vote
0 answers
104 views

Kernel ROP crashes running OS

I was experimenting to see if I can make an ROP chain within the kernel. In the kernel debugging mode, I can make the first jump to an arbitrary gadget address without any problem. But the problem ...
perplex's user avatar
  • 31
0 votes
1 answer
551 views

What is the best way to restrict /proc fs from malicious users (linux)?

I am trying to make a restriction to procfs like only a certain groups of members can perform read and write actions. kernel document says we can do that by setting hidepid and gid in /etc/fstab. It ...
Karthik Nedunchezhiyan's user avatar
0 votes
1 answer
286 views

Vulnerable stored Linux kernel version

I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version: user@host [~]# rpm -q kernel kernel-3.10.0-327.el7.x86_64 kernel-3....
user187205's user avatar
  • 1,293
1 vote
0 answers
133 views

Kernel exploit fails after executing first command

While trying to solve old ctf task (https://blog.frizn.fr/plaidctf-2013/pwn-400-servr) I've encountered a situation which I don't understand. TLTR After escalating process privileges my exploit ...
Rob D's user avatar
  • 51
0 votes
2 answers
270 views

Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?

We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary. We're in the process of ...
xavor's user avatar
  • 1
6 votes
1 answer
1k views

How to hide Kernel Symbols in Linux Kernel Image? Recompliation?

Why hide kernel symbols? Quote Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
adrelanos's user avatar
  • 744
5 votes
1 answer
337 views

Can a non-privileged user modify the file descriptor table of an elevated process?

In Linux, every process holds its own file descriptor table, which keeps references to all opened files and file-like devices. This table is managed by the kernel. Is it possible that a non-...
user avatar
2 votes
1 answer
515 views

Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]

I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS. I have just one question: Is it a mandatory to ...
Asm .'s user avatar
  • 59
0 votes
2 answers
169 views

Is exploit different from the kernel level or root?

I'm learning about privilege escalation. I'm trying exploits in my lab machine like vulnhub. In my opinion, if I successfully run the exploit linux/local/udev/net_link, I can read etc/shadow and etc/...
pfaclix's user avatar
1 vote
1 answer
635 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
Michael Roth's user avatar