Questions tagged [kernel]
The kernel tag has no usage guidance.
143
questions
0
votes
1
answer
539
views
Assigning memory address of shellcode to buffer (for buffer overflow input)
I am attempting to exploit HEVD kernel driver buffer overflow challenge:
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
However when running the below code my windows 7 machine doesn't ...
CommunityBot
- 1
0
votes
1
answer
1k
views
How to build Linux Volatility Profiles With the Compiled Kernel
I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case.
I heard there is a way to build the ...
CommunityBot
- 1
3
votes
1
answer
405
views
How does an eBPF program cause a kernel panic?
According to this RedHat knowledge base entry CrowdSource has similarly caused a kernel panic on Linux as well with eBPF program.
My question is how is this possible? eBPF is described as,
eBPF ...
- 1,220
0
votes
0
answers
21
views
Verify Executables/Application before launching [duplicate]
Linux kernel has a feature to verify Linux kernel modules before loading them. This verification assures that modification made to Linux kernel is authentic. Does kernel have similar features to ...
- 132k
7
votes
1
answer
2k
views
Does CrowdStrike Falcon get validated by the Windows kernel as being crash-free?
With Linux, eBPF programs are validated as not causing crashes. Apparently that validation has had errors previously because of bugs in the Linux kernel.
How is CrowdStrike Falcon implemented on ...
- 115
1
vote
3
answers
220
views
Does emulation/software virtualization provide more isolation/security vs hardware virtualization?
From my understanding:
I can emulate many different architectures and systems with qemu as a user(mode) process.
There is separate user address space per process.
If a malicious process were to ...
CommunityBot
- 1
1
vote
0
answers
27
views
Why is the "Scope Changed" CVSS Metric for Kernel Crash Vectors always "Unchanged"? [closed]
Looking at all the recent Linux kernel crash CVEs I see that the "Scope Changed" metric is always "Unchanged" indicating that "The vulnerable component is the affected ...
- 1,259
1
vote
0
answers
72
views
How relevant are OS security measures for everyday single-user personal computers? [closed]
For example, Meltdown and Spectre are serious security issues since they allow application to read unauthorized memory. However, from my understanding, most everyday computer setup allow any untrusted ...
- 17.1k
6
votes
4
answers
5k
views
Will installing a kernel mode driver onto a PC compromise the entire network it's connected to?
At home, my personal PC and work computers all connect to the same network, via ethernet and WiFi.
A video game on my personal PC is requiring an install of a "kernel mode driver." At the ...
- 193
0
votes
0
answers
142
views
What is Virtual Secure Mode trying to achieve?
I recently learned about the feature in Windows 10 called Windows Secure Mode (https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm). I'm trying to understand what exactly it ...
- 303
11
votes
0
answers
419
views
Penetration-resistance of a HaLVM unikernel
A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
- 11
0
votes
2
answers
215
views
Is exploit different from the kernel level or root?
I'm learning about privilege escalation.
I'm trying exploits in my lab machine like vulnhub.
In my opinion, if I successfully run the exploit linux/local/udev/net_link, I can read etc/shadow and etc/...
- 132k
0
votes
2
answers
321
views
Kernel level attack?
In a Unix-like system, the concept of privileged and non-privileged users is used for security, preventing numerous attacks. When a non-privileged user executes malicious code at a normal level, the ...
- 170
1
vote
0
answers
183
views
How does IOMMU and/or Linux kernel handle DMA that span a page boundary?
I am looking into how DMA works at the device driver and kernel level in the Linux kernel.
I observed that access control to DMA buffers from IO devices is performed by the IOMMU and IOMMU driver in ...
- 41
1
vote
0
answers
120
views
Is having no driver installed better than having old driver?
How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates?
On older PCs and laptops where some components are no ...
1
vote
2
answers
466
views
Is Zircon kernel (from Fuchsia OS) safer by being a microkernel?
Fuchsia's possible Android replacement uses the Zircon microkernel. This means that the drivers should run in userspace.
Is this an advantage over Android? For example, closed source drivers now can't ...
19
votes
3
answers
40k
views
Pros and cons of disabling TCP timestamps
So, lynis informs me that I should unset net.ipv4.tcp_timestamps.
I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
- 1
2
votes
1
answer
166
views
Linux BPFtrace - user switch from suid bit applications not detected
I want to monitor systemcalls with bpftrace (https://github.com/iovisor/bpftrace/). For most systemcalls, this works without problems, but I have problems to monitor applications, where the suid bit ...
- 1,482
0
votes
1
answer
1k
views
user namespaces: do they increase security, or introduce new attack surface?
user namespaces in Linux are presented as a security feature, which should increase security. But is this really true?
Is it possible that while user namespaces fix one kind of problem, they introduce ...
- 205k
0
votes
2
answers
327
views
Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?
We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary.
We're in the process of ...
CommunityBot
- 1
0
votes
1
answer
106
views
Why does this method of modifying kernel memory work?
I have no experience of kernel programming or anything low level. I just watched this video and at 21:10 the presenter started to talk about modifying kernel memory using two pointers.
From my ...
- 61
5
votes
1
answer
2k
views
Explanation of capabilities: CAP_NET_BIND_SERVICE
I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain.
I am in a VM (Kali).
❯ uname -a
...
- 205
0
votes
1
answer
460
views
Capabilities DROP in container of Kubernetes pod running with specific UID
I am doing some security research on Kubernetes and I found something still mysterious to me, concerning capabilities.
Example of simple pod:
apiVersion: v1
kind: Pod
metadata:
name: my-pod-httpd
...
- 62.5k
4
votes
1
answer
652
views
Linux 'add_interrupt_randomness' implementation - low entropy contribution by cycles and jiffies?
Currently I'm analyzing the process of entropy generation of a Linux 64-bit kernel during system startup (for educational purpose). The system is hosted as/on a (64 bit) virtual machine (Xen domU). ...
- 67.1k
1
vote
0
answers
198
views
Was the kernel I used vulnerable/deprecated?
Background Information
As I developer I am running multiple (partly virtual-)machines with Debian GNU/Linux and on some of these machines I work with highly confidential documents or dangerous ...
- 132k
29
votes
1
answer
6k
views
DMA attacks despite IOMMU isolation
If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
- 67.1k
0
votes
1
answer
1k
views
Is there a difference between a bootkit and a ring-0 rootkit?
I understand the difference between a Ring-0 rootkit and a Ring-3 rootkit, in terms of their hierarchical depth in computational models. That is kernel mode and usermode, respectively.
I am confused ...
- 5,056
0
votes
0
answers
836
views
A Continuous Flood of Kernel Warnings. Am I under attack?
I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode.
My syslog reports continuously, many times per second stuff like this:
...
- 101
5
votes
1
answer
2k
views
How can you detect kernel exploits?
Is there something that all kernel exploits have in common?
Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
- 67.1k
2
votes
1
answer
163
views
Security of a ro volume in Docker
What are the security implications of mapping a host folder to a Docker container ro? For example -v /usr/local/bin:/usr/local/bin:ro.
Of course, the container can now read the host folder. But, ...
- 62.5k
2
votes
1
answer
402
views
Container escape - CVE-2022-0492 - hybrid cgroups?
I saw the recent CVE-2022-0492 that can enable container escape, and I have a decent understanding of cgroups and container capabilities, but not very familiar with how hybrid cgroup v1/v2 works, nor ...
- 126
1
vote
1
answer
300
views
How does gVisor run its own kernel replacement under Docker for security? [closed]
I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security.
My question is: The whole point ...
- 101
7
votes
1
answer
2k
views
How to hide Kernel Symbols in Linux Kernel Image? Recompliation?
Why hide kernel symbols?
Quote
Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
- 2,275
2
votes
1
answer
643
views
Linux security modules (LSM) and reference monitor implementation
as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision.
Furthermore, I think the Linux ...
CommunityBot
- 1
0
votes
0
answers
155
views
How to execute Android verified boot during first boot after updating OS in Android?
I need to execute AVB (Android verified boot) during first boot after updating Android OS. BOARD_AVB_ENABLE = true is already present in the mk file device/hikey/common/BoardConfigCommon.mk in the ...
- 11.6k
0
votes
2
answers
671
views
How to completely restrict Steam in Linux to defend against remote zero day exploits?
My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
- 410
1
vote
1
answer
388
views
What physical damage can a user mode windows driver do?
If a driver runs in kernel mode it obviously can manipulate everything (well everything in ring 0), so manipulating the file system or devices is a possibility. Potentially devices can be destroyed, ...
- 50.3k
1
vote
0
answers
316
views
How to go about checking if Windows is running any untrusted drivers (programatically)
I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
- 111
7
votes
2
answers
6k
views
Can mprotect() be used to change the permissions of .rodata?
The .rodata segment in ELF files contains data that is not meant to be changed. By default, all pages from this segment are read-only, and any attempt at modification will trigger a general protection ...
- 67.1k
1
vote
3
answers
410
views
Can a running kernel be protected by underlying rings, BIOS etc?
I mostly found examples the other way around: compromising the OS e.g. through a compromised BIOS or Intel ME.
But are there known examples where stuff runs underneath the kernel and can be used to ...
- 67.1k
10
votes
2
answers
941
views
How effective is Windows KDP for exploit mitigation in practice?
Windows Kernel Data Protection is a kernel security feature which appears to use Extended Page Tables (EPT, a hardware virtualization feature) to enforce read-only pages. How effective is this at ...
CommunityBot
- 1
3
votes
1
answer
2k
views
What is KSPP (Kernel self-protection project)?
What is KSPP? I saw it being compared to and called a competitor to grsecurity, but I can't find a patch or Git repository to download.
Is it just an idea/manifesto or something real, with a concrete ...
- 67.1k
4
votes
2
answers
6k
views
How to disable conntrack protocol parsing in the linux kernel?
Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
- 67.1k
0
votes
1
answer
201
views
How to detect fileless kernel compromise in linux
Is there a way to detect fileless kernel compromise in Linux?
The only one way to analyze this kind of attack is by volatility. Volatility is a very good product, but not often updated especially with ...
- 16.9k
2
votes
1
answer
2k
views
linux kernel security module smack transmutation example
In the kernel documentation for smack security module it reads: "If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that ...
- 2,667
2
votes
1
answer
2k
views
How to load a malicious LKM at startup?
How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
- 2,275
1
vote
0
answers
225
views
ctf kernel challenges does not work [closed]
I'm trying to learn and solve some 'kernel related' ctf challenges (reading writups to try to run same environment and achieve root using one of the kernel-pwn technique...).
I'm using Ubuntu 20 VM ...
- 132k
1
vote
0
answers
118
views
Can XIP (execute in place) be used for kernel protection?
Starting with kernel 5.13 RiscV will get XIP where parts of the kernel run from non volatile memory like flash. In theory you could make parts of the kernel really read only either from the hardware ...
- 11
3
votes
0
answers
198
views
Identifying kernel pointer infoleaks via static analysis
Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
- 67.1k
2
votes
2
answers
3k
views
How protected mode in CPU is really implemented?
I know what is real and protected mode of cpu execution. But how CPU implements protected mode ? AFAIK cpu does everything what the program says it to do. Where is the protected mode behaviour ...
