Questions tagged [kernel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4
votes
0answers
112 views

How to hide Kernel Symbols in Linux Kernel Image? Recompliation?

Why hide kernel symbols? Quote Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
5
votes
1answer
146 views

Can a non-privileged user modify the file descriptor table of an elevated process?

In Linux, every process holds its own file descriptor table, which keeps references to all opened files and file-like devices. This table is managed by the kernel. Is it possible that a non-...
2
votes
1answer
81 views

Countering a system killing UID/GID=0 processes in Android

Suppose that there were a security system in an Android kernel meant to prevent exploits that have arbitrary kernel memory read/write from getting root privileges. This system, Kills a process by ...
1
vote
0answers
90 views

Why can leaking a kernel pointer be dangerous? [closed]

Which attacks can be executed with a leaked pointer?
2
votes
1answer
192 views

Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]

I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS. I have just one question: Is it a mandatory to ...
0
votes
1answer
63 views

Is exploit different from the kernel level or root?

i'm searching privilage escalation. there is some way if you looking at. i trying exploit in my lab machine like vulnhub. there is a diagram for understanding differents. anyway I told you a little. ...
1
vote
1answer
107 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
0
votes
0answers
88 views

VDSL modem getting probed?

My ZyXEL VMG8924-B30A VDSL modem recently had these alerts in its log. The WAN IP address of the modem is 10.225.205.128. There was nothing like this before 1 May. What is this? 2019 -05 -01 T16:05:...
0
votes
0answers
40 views

How to find out what program called an API in windows?

Okay, so I am developing a kernel module that does kernel mode hooking to hook APIs and modify some values. But is there anyway I could tell if what program called a specific API? Say a program from ...
1
vote
1answer
171 views

Why it is difficult to write an application to protect 100% against keyloggers?

When you press keystrokes, I suppose you can intercept in low level code all applications that listen and record. Why it cannot be designed a software that protects 100% against keyloggers, simply ...
1
vote
1answer
242 views

linux kernel exploit shellcode causes segfault

I'm learning how to write kernel exploits and my shellcode keeps seg faulting. I'm getting the memory address for commit_creds(prepare_kernel_cred(0)); #grep commit_creds /proc/kallsyms c907eea0 T ...
0
votes
0answers
52 views

get process task_struct address in kernel memory from /proc/<pid>

I am working on a vulnerable sandbox environnement (x86 64 bits) I can write any byte in kernel's memory. I want to know the address of task_struct for my shell process in order to give to it an uid ...
0
votes
0answers
91 views

Secure way to sign virtualbox module for secure boot

I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
2
votes
0answers
40 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
0
votes
0answers
27 views

Sign windows kernel with self signed ca

I want to a security experiment on my machine since I have UEFI now and this allows me to install custom UEFI PK etc. Is it possible that I can install next to the Microsoft PK my own PK in order to ...
2
votes
1answer
477 views

Is Meltdown/Spectre mitigation necessary in virtual machine as well as in hypervisor? [duplicate]

I am running virtual machines in kvm/qemu hypervisor. The hypervisor has Meltdown/Spectre mitigation enabled in kernel. Is it necessary that virtual machines have the Meltdown/Spectre mitigation ...
3
votes
0answers
77 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
3
votes
1answer
203 views

Does printk() cause any security issues?

I'm asking myself if the function printk() causes security issues on Linux. When an attacker has user level access to the system, does it make his life easier if he has access to kernel pointers? Does ...
1
vote
1answer
541 views

Is Debian 9.5 stretch vulnerable to CVE-2018-17182?

I have a Debian system running the following kernel version: Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
1
vote
2answers
689 views

How protected mode in CPU is really implemented?

I know what is real and protected mode of cpu execution. But how CPU implements protected mode ? AFAIK cpu does everything what the program says it to do. Where is the protected mode behaviour ...
0
votes
1answer
459 views

The older the Linux kernel is, the more secure?

Are there security benefits running Linux Distro base on an older version of Linux kernel? Security benefits = fewer vulnerabilities that can be exploited by hackers. Linux Distro base on older ...
3
votes
1answer
300 views

How to fix Spectre variant 3a and variant 4?e

How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
1
vote
0answers
148 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
5
votes
3answers
2k views

Is the Linux kernel vulnerable to LazyFP (CVE-2018-3665)?

Recently, a side-channel attack was discovered that exploits lazy FPU state switching to leak the contents of MMX, SSE, and AVX registers. The vulnerability can only be exploited when lazy FPU saves ...
3
votes
1answer
244 views

Injecting data into the Windows entropy pool

On Linux, it is possible for userspace to mix arbitrary data with the kernel entropy pool by writing to the /dev/urandom device. Is there any equivalent on Windows which does not require SYSTEM?
0
votes
0answers
166 views

Why does Ubuntu deem 16.04 un-affected by CVE-2017-16995(Kernel Privilege Escalation) while it's not?

In both current OVAL definition and CVE Tracker, it says for Ubuntu 16.04 While related to the CVE in some way, the 'linux' package in xenial is not affected. But I have tested many kernel ...
3
votes
1answer
192 views

Linux 'add_interrupt_randomness' implementation - low entropy contribution by cycles and jiffies?

Currently I'm analyzing the process of entropy generation of a Linux 64-bit kernel during system startup (for educational purpose). The system is hosted as/on a (64 bit) virtual machine (Xen domU). ...
2
votes
1answer
546 views

Kernel32.dll , Kernelbase.dll and Malware

I noticed that the same malware will export CreateProcessInternalW from kernel32.dll in Windows 7 and KernelBase.dll in Windows 10. Why is it exporting the same function from different DLLs?
1
vote
2answers
79 views

Driver separation?

are there any (at least on plan or theoretical level) that drivers will be/are/would be separated in general? ex.: touchpad drivers shouldn't have to do anything with network access wireless drivers ...
2
votes
1answer
704 views

How detrimental is a NULL pointer dereference vulnerability today?

Recently I have been reading about the implications of NULL pointer dereferences in kernel code (often LKMs/modules), specifically escalating privileges to root via mmap()ing the NULL page and then ...
6
votes
2answers
383 views

Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?

The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another. On my Linux system currently I have all JavaScript disabled to eliminate ...
14
votes
1answer
735 views

Is anyone seeing a performance decrease after applying recent kernel patch fixing Meltdown and Spectre? [closed]

Our company has a lot of CPU intensive operations on our servers, so the performance decrease is a concern for the organization. We did the benchmarks, and it seems that performance is almost not ...
5
votes
2answers
725 views

Linux Kernel ROP - Returning to userland from kernel context?

I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to ...
8
votes
1answer
417 views

Mitigating Meltdown by checking the faulting address in every page fault?

Short question Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
1
vote
1answer
306 views

How can a userspace linux process refer to a kernel address?

I would like help understanding a particular aspect of meltdown. My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a ...
8
votes
3answers
2k views

Why is accessing kernel memory a security risk?

A lot of the news regarding the Meltdown vulnerability is emphasizing that it allows programs to read memory that should be off limits to the user. While I understand that this should not happen, few ...
23
votes
1answer
1k views

Which attacks are known that exploit the vulnerability known as Spectre?

As reported yesterday the Linux and Windows kernels will receive a security update pretty soon to close vulnerabilities that concern 'kernel memory leaking'. What exactly the design flaw is, that ...
3
votes
0answers
157 views

What is known about the latest vulnerability related to Linux Page Table Isolation patches? [duplicate]

Recently, on Hacker News front page, there was a post mentioning a new vulnerability that seems to affect Intel processors. The post is mostly speculation and there is no PoC or an exploit that I'm ...
23
votes
1answer
3k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
2
votes
1answer
870 views

What is KSPP (Kernel self-protection project)?

What is KSPP? I saw it being compared to and called a competitor to Grsecurity, but I can't find a patch or Git repository to download. Is it just an idea/manifesto or something real, with a concrete ...
2
votes
1answer
554 views

How to load a malicious LKM at startup?

How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
5
votes
1answer
1k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
3
votes
2answers
3k views

Can mprotect() be used to change the permissions of .rodata?

The .rodata section in ELF files contains parts of the text segment that are not meant to be changed. By default, all pages from this section are read-only, and any attempt at modification will ...
2
votes
0answers
348 views

Detect kASLR/ASLR within a Linux firmware image without running it

I'm currently looking into exploit mitigation techniques and I've come across a question I can't find an answer to just now. To detect the presence of let's says PIE or Canaries within a binary there ...
1
vote
1answer
94 views

What architecture could be suitable for a secure environment?

According to these slides on replacing UEFI with Linux: Between Linux and the hardware are at least 2 ½ kernels. Are there any architectures that contain fewer layers between the main OS and the ...
1
vote
0answers
242 views

Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]

What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted. I am overwriting with, setting frame like this: /* * Setup the fake frame *...
1
vote
1answer
455 views

Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]

Why it segfaults in __kernel_vsyscall+9? Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c (gdb) x/10x 0xb7fd9ce5 0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
1
vote
2answers
161 views

Can a running kernel be protected by underlying rings, BIOS etc?

I mostly found examples the other way around: compromising the OS e.g. through a compromised BIOS or Intel ME. But are there known examples where stuff runs underneath the kernel and can be used to ...
1
vote
1answer
1k views

Do Linux kernels have guard pages?

I'm new to the Linux kernel, how does the Linux kernel memory management use guard pages (if this feature even exists)?
5
votes
1answer
1k views

OpenBSD is implementing KARL. How does this improve security?

According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer. It is called KARL, "Kernel Address Randomized Link". ...