Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [kernel]

The tag has no usage guidance.

2
votes
0answers
31 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
0
votes
0answers
18 views

Sign windows kernel with self signed ca

I want to a security experiment on my machine since I have UEFI now and this allows me to install custom UEFI PK etc. Is it possible that I can install next to the Microsoft PK my own PK in order to ...
2
votes
1answer
107 views

Is Meltdown/Spectre mitigation necessary in virtual machine as well as in hypervisor? [duplicate]

I am running virtual machines in kvm/qemu hypervisor. The hypervisor has Meltdown/Spectre mitigation enabled in kernel. Is it necessary that virtual machines have the Meltdown/Spectre mitigation ...
2
votes
0answers
38 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
2
votes
1answer
93 views

Does printk() cause any security issues?

I'm asking myself if the function printk() causes security issues on Linux. When an attacker has user level access to the system, does it make his life easier if he has access to kernel pointers? Does ...
1
vote
1answer
313 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
1
vote
2answers
242 views

How protected mode in CPU is really implemented?

I know what is real and protected mode of cpu execution. But how CPU implements protected mode ? AFAIK cpu does everything what the program says it to do. Where is the protected mode behaviour ...
0
votes
1answer
191 views

The older the Linux kernel is, the more secure?

Are there security benefits running Linux Distro base on an older version of Linux kernel? Security benefits = fewer vulnerabilities that can be exploited by hackers. Linux Distro base on older ...
3
votes
1answer
217 views

How to fix Spectre variant 3a and variant 4?e

How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
0
votes
0answers
29 views

Fully patched Windows 2008 immediate BSOD from low privilege account

Is there any exploit/script/vulnerability where a very low privileged user can trigger a BSOD or reboot? I'm familiar with the USB exploit, but I'm wondering if its possible with some remote method? ...
1
vote
0answers
102 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
5
votes
3answers
2k views

Is the Linux kernel vulnerable to LazyFP (CVE-2018-3665)?

Recently, a side-channel attack was discovered that exploits lazy FPU state switching to leak the contents of MMX, SSE, and AVX registers. The vulnerability can only be exploited when lazy FPU saves ...
2
votes
1answer
198 views

Injecting data into the Windows entropy pool

On Linux, it is possible for userspace to mix arbitrary data with the kernel entropy pool by writing to the /dev/urandom device. Is there any equivalent on Windows which does not require SYSTEM?
0
votes
0answers
156 views

Why does Ubuntu deem 16.04 un-affected by CVE-2017-16995(Kernel Privilege Escalation) while it's not?

In both current OVAL definition and CVE Tracker, it says for Ubuntu 16.04 While related to the CVE in some way, the 'linux' package in xenial is not affected. But I have tested many kernel ...
3
votes
1answer
120 views

Linux 'add_interrupt_randomness' implementation - low entropy contribution by cycles and jiffies?

Currently I'm analyzing the process of entropy generation of a Linux 64-bit kernel during system startup (for educational purpose). The system is hosted as/on a (64 bit) virtual machine (Xen domU). ...
2
votes
1answer
389 views

Kernel32.dll , Kernelbase.dll and Malware

I noticed that the same malware will export CreateProcessInternalW from kernel32.dll in Windows 7 and KernelBase.dll in Windows 10. Why is it exporting the same function from different DLLs?
1
vote
2answers
62 views

Driver separation?

are there any (at least on plan or theoretical level) that drivers will be/are/would be separated in general? ex.: touchpad drivers shouldn't have to do anything with network access wireless drivers ...
2
votes
1answer
412 views

How detrimental is a NULL pointer dereference vulnerability today?

Recently I have been reading about the implications of NULL pointer dereferences in kernel code (often LKMs/modules), specifically escalating privileges to root via mmap()ing the NULL page and then ...
4
votes
2answers
311 views

Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?

The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another. On my Linux system currently I have all JavaScript disabled to eliminate ...
14
votes
1answer
720 views

Is anyone seeing a performance decrease after applying recent kernel patch fixing Meltdown and Spectre? [closed]

Our company has a lot of CPU intensive operations on our servers, so the performance decrease is a concern for the organization. We did the benchmarks, and it seems that performance is almost not ...
5
votes
2answers
479 views

Linux Kernel ROP - Returning to userland from kernel context?

I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to ...
8
votes
1answer
341 views

Mitigating Meltdown by checking the faulting address in every page fault?

Short question Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
1
vote
1answer
268 views

How can a userspace linux process refer to a kernel address?

I would like help understanding a particular aspect of meltdown. My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a ...
8
votes
3answers
1k views

Why is accessing kernel memory a security risk?

A lot of the news regarding the Meltdown vulnerability is emphasizing that it allows programs to read memory that should be off limits to the user. While I understand that this should not happen, few ...
22
votes
1answer
1k views

Which attacks are known that exploit the vulnerability known as Spectre?

As reported yesterday the Linux and Windows kernels will receive a security update pretty soon to close vulnerabilities that concern 'kernel memory leaking'. What exactly the design flaw is, that ...
3
votes
0answers
156 views

What is known about the latest vulnerability related to Linux Page Table Isolation patches? [duplicate]

Recently, on Hacker News front page, there was a post mentioning a new vulnerability that seems to affect Intel processors. The post is mostly speculation and there is no PoC or an exploit that I'm ...
9
votes
0answers
1k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
2
votes
1answer
605 views

What is KSPP (Kernel self-protection project)?

What is KSPP? I saw it being compared to and called a competitor to Grsecurity, but I can't find a patch or Git repository to download. Is it just an idea/manifesto or something real, with a concrete ...
2
votes
1answer
327 views

How to load a malicious LKM at startup?

How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
4
votes
1answer
736 views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
2
votes
2answers
2k views

Can mprotect() be used to change the permissions of .rodata?

The .rodata section in ELF files contains parts of the text segment that are not meant to be changed. By default, all pages from this section are read-only, and any attempt at modification will ...
2
votes
0answers
241 views

Detect kASLR/ASLR within a Linux firmware image without running it

I'm currently looking into exploit mitigation techniques and I've come across a question I can't find an answer to just now. To detect the presence of let's says PIE or Canaries within a binary there ...
1
vote
1answer
91 views

What architecture could be suitable for a secure environment?

According to these slides on replacing UEFI with Linux: Between Linux and the hardware are at least 2 ½ kernels. Are there any architectures that contain fewer layers between the main OS and the ...
1
vote
0answers
212 views

Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]

What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted. I am overwriting with, setting frame like this: /* * Setup the fake frame *...
1
vote
1answer
340 views

Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]

Why it segfaults in __kernel_vsyscall+9? Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c (gdb) x/10x 0xb7fd9ce5 0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
1
vote
2answers
124 views

Can a running kernel be protected by underlying rings, BIOS etc?

I mostly found examples the other way around: compromising the OS e.g. through a compromised BIOS or Intel ME. But are there known examples where stuff runs underneath the kernel and can be used to ...
1
vote
1answer
912 views

Do Linux kernels have guard pages?

I'm new to the Linux kernel and I was trying to understand memory management better by reading up on function calls, prologues, assembly etc. However it occurred to me that the Linux kernel might ...
6
votes
1answer
794 views

OpenBSD is implementing KARL. How does this improve security?

According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer. It is called KARL, "Kernel Address Randomized Link". ...
6
votes
1answer
731 views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
1
vote
1answer
74 views

Extreme buffer size consequences

What are the consequences of allocating and then populating an extremely large buffer in C? Can a stack have a maximum size and if so what are the security mechanisms that enforce this.
4
votes
1answer
127 views

How does Windows schedule a thread when the thread has no process?

I have heard that some rootkits try to hide themselves by destroying the process object (nt!_EPROCESS ?) but keeping the thread alive (nt!_ETHREAD ?) . That way they are not visible in tools like Task ...
0
votes
0answers
113 views

CVE-2016-0728 exploit

I've found this PoC and as many people said, it didn't work. I inserted printk into join_session_keyring and key_revoke, recompiled kernel, modified the number of loop and checked that refcount is ...
15
votes
2answers
3k views

Does a compromised kernel give complete control over a device?

It seems that a recent vulnerability in WiFi firmware allows an attacker to run code in kernel space, e.g. replace a kernel function with malicious code. In Android/Linux: Would that give an ...
5
votes
2answers
134 views

Is it possible for unprivileged user to modify/inject into other user's (root) process?

Although I'm not any kind of kernel specialist and I do not program in languages like C/C++ and thus I do not have deep understanding of critical concepts of managing processes at OS level I do have ...
0
votes
1answer
445 views

What hardware can a user-mode process access?

What hardware if any can a process in user-mode (as opposed to kernel mode) access without using system calls, e.g. without relying on the OS to do anything for it? This question should be operating ...
4
votes
2answers
785 views

Can USB ethernet passthrough to a KVM virtual machine isolate network-related kernel vulnerabilities?

I'm worried about the attack surface that the linux kernel networking stack, including nic drivers and packet filtering, offers to a remote attacker. So I'm planning to isolate as much of the ...
0
votes
1answer
71 views

Possible ways for hackers to alter kernel behaviour without root [closed]

I'm wondering is it possible to harm kernel (by injecting shared library, loadable module or something like that) without root. If yes, how hackers can achieve it?
2
votes
0answers
120 views

Why isn't the “RAP - Reuse Attack Protector” in the mainline Linux kernel?

https://grsecurity.net/rap_announce_ret.php https://grsecurity.net/download.php#test Q: If the RAP - Reuse Attack Protector - is such an extreme great idea, why isn't it already included in the ...
-1
votes
1answer
222 views

Few questions about kernel attacks

Yesterday I read something about kernel and possible attacks on it. And I have some questions about this attack approach: 1. Kernel is a core for whole OS. So if I take control over kernel can I do ...
3
votes
2answers
282 views

Randomizing system call numbers to prevent rootkits?

I've heard of rootkits that infect computers by first having a simple virus infect the computer, make a call to the "command" computer containing the target computer's specs. With the specs, the ...