Questions tagged [kernel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
0 votes
1 answer
200 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
-2 votes
0 answers
30 views

Linux kernel version 4.x [closed]

I'm applying for a Linux developer job. One of the questions is: "What linux distro uses version 4.X (specifically, version 4.4x)?"
5 votes
1 answer
2k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
0 votes
1 answer
450 views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
29 votes
1 answer
5k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
2 votes
1 answer
44 views

Security of a ro volume in Docker

What are the security implications of mapping a host folder to a Docker container ro? For example -v /usr/local/bin:/usr/local/bin:ro. Of course, the container can now read the host folder. But, ...
0 votes
0 answers
19 views

How To First Strip and Then Sign Kernel Modules at Complie Time

It seems easy to sign kernel modules at compile time. Apparently, you just set CONFIG_MODULE_SIG_ALL=y in your .config file and then the compiler will perhaps give you the appropriate errors until you ...
1 vote
1 answer
121 views

Container escape - CVE-2022-0492 - hybrid cgroups?

I saw the recent CVE-2022-0492 that can enable container escape, and I have a decent understanding of cgroups and container capabilities, but not very familiar with how hybrid cgroup v1/v2 works, nor ...
1 vote
1 answer
87 views

How does gVisor run its own kernel replacement under Docker for security? [closed]

I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security. My question is: The whole point ...
5 votes
1 answer
927 views

How to hide Kernel Symbols in Linux Kernel Image? Recompliation?

Why hide kernel symbols? Quote Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
0 votes
0 answers
72 views

Tips for auditing/finding a better/trusted source for an anonymous but open source network device linux driver from some random github repo

Maybe because I am a cheap bastard or just because I saw no better alternative in the market in terms of reported performance and functionality vs. size, I bought this USB bluetooth/WiFi5 dongle: ...
1 vote
1 answer
318 views

Linux security modules (LSM) and reference monitor implementation

as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision. Furthermore, I think the Linux ...
0 votes
0 answers
76 views

How to execute Android verified boot during first boot after updating OS in Android?

I need to execute AVB (Android verified boot) during first boot after updating Android OS. BOARD_AVB_ENABLE = true is already present in the mk file device/hikey/common/BoardConfigCommon.mk in the ...
0 votes
2 answers
311 views

How to completely restrict Steam in Linux to defend against remote zero day exploits?

My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
1 vote
1 answer
171 views

What physical damage can a user mode windows driver do?

If a driver runs in kernel mode it obviously can manipulate everything (well everything in ring 0), so manipulating the file system or devices is a possibility. Potentially devices can be destroyed, ...
0 votes
0 answers
118 views

Is W^X enforced against UEFI DXE drivers (firmware)? Could it be if we tried?

W^X is a critical security feature, allowing us a chance to perform security analysis on data that some entity on a computer wants to execute. Windows implements this by requiring a process to call ...
1 vote
0 answers
112 views

How to go about checking if Windows is running any untrusted drivers (programatically)

I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
0 votes
0 answers
72 views

Should Parrot Sec Contain 3 sys_call_table?

I noticed that if I grep the system.map in Parrot Sec 4.10 for sys_call_table it returns three results. I have reason to believe the workstation I first did this on was compromised, so I installed a ...
2 votes
1 answer
214 views

Is Zircon kernel (from Fuchsia OS) safer by being a microkernel?

Fuchsia's possible Android replacement uses the Zircon microkernel. This means that the drivers should run in userspace. Is this an advantage over Android? For example, closed source drivers now can't ...
6 votes
2 answers
5k views

Can mprotect() be used to change the permissions of .rodata?

The .rodata segment in ELF files contains data that is not meant to be changed. By default, all pages from this segment are read-only, and any attempt at modification will trigger a general protection ...
0 votes
0 answers
71 views

bluetooth link encrytion under bluetooth 4 .2 and 5.x

This is a follow up question regarding this answer In Linux does the encryption of the bluetooth link using bluetooth 4.2 or 5.x depend on the version of the kernel - and whether or not the kernel ...
1 vote
3 answers
321 views

Can a running kernel be protected by underlying rings, BIOS etc?

I mostly found examples the other way around: compromising the OS e.g. through a compromised BIOS or Intel ME. But are there known examples where stuff runs underneath the kernel and can be used to ...
9 votes
2 answers
496 views

How effective is Windows KDP for exploit mitigation in practice?

Windows Kernel Data Protection is a kernel security feature which appears to use Extended Page Tables (EPT, a hardware virtualization feature) to enforce read-only pages. How effective is this at ...
3 votes
1 answer
2k views

What is KSPP (Kernel self-protection project)?

What is KSPP? I saw it being compared to and called a competitor to grsecurity, but I can't find a patch or Git repository to download. Is it just an idea/manifesto or something real, with a concrete ...
4 votes
1 answer
422 views

Linux 'add_interrupt_randomness' implementation - low entropy contribution by cycles and jiffies?

Currently I'm analyzing the process of entropy generation of a Linux 64-bit kernel during system startup (for educational purpose). The system is hosted as/on a (64 bit) virtual machine (Xen domU). ...
5 votes
2 answers
5k views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
0 votes
1 answer
130 views

How to detect fileless kernel compromise in linux

Is there a way to detect fileless kernel compromise in Linux? The only one way to analyze this kind of attack is by volatility. Volatility is a very good product, but not often updated especially with ...
2 votes
1 answer
2k views

linux kernel security module smack transmutation example

In the kernel documentation for smack security module it reads: "If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that ...
2 votes
1 answer
1k views

How to load a malicious LKM at startup?

How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
1 vote
0 answers
136 views

ctf kernel challenges does not work [closed]

I'm trying to learn and solve some 'kernel related' ctf challenges (reading writups to try to run same environment and achieve root using one of the kernel-pwn technique...). I'm using Ubuntu 20 VM ...
1 vote
0 answers
71 views

Can XIP (execute in place) be used for kernel protection?

Starting with kernel 5.13 RiscV will get XIP where parts of the kernel run from non volatile memory like flash. In theory you could make parts of the kernel really read only either from the hardware ...
3 votes
0 answers
153 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
2 votes
2 answers
2k views

How protected mode in CPU is really implemented?

I know what is real and protected mode of cpu execution. But how CPU implements protected mode ? AFAIK cpu does everything what the program says it to do. Where is the protected mode behaviour ...
3 votes
1 answer
1k views

Dirtycow runs (lib-c to root) fine but crashes on reboot

I have ubuntu 14.04.3 server running in a vm with kernel version 3.13.0-83-generic running. I have tested several PoC's gathered here. Most of them crash the kernel (not all the times but sometimes) ...
0 votes
1 answer
97 views

Vulnerability in which part of the Android architecture would allow an attacker to take control of the hardware [closed]

This question is intended for better understanding of security features of Android architecture. In particular, I want to know what part of the architecture needs to be secure to prevent an attacker ...
1 vote
0 answers
123 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
0 votes
2 answers
230 views

Does a (kernel) exploit always need to use system calls?

It was mentioned in this thread that kernel exploits usually use syscalls to trigger undesired behavior: How can you detect kernel exploits? Are there any ways or known examples which do not use ...
2 votes
1 answer
434 views

Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]

I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS. I have just one question: Is it a mandatory to ...
1 vote
1 answer
312 views

Vulnerabilities for multiple kernel versions that are installed on a given server

As per Exclude or display vulnerabilities for non-running Linux kernels : It is possible to have multiple kernels detected on a single Linux host and Qualys will report all vulnerabilities found on ...
2 votes
2 answers
120 views

Is it possible to determinate which functions a kernel module calls?

Trusting kernel drivers is bad. Is there something we can do to have at least an idea about what it does? For example, let's suppose an armv8a linux kernel. I'd search for all the syscalls, which ...
2 votes
1 answer
601 views

What are the dangers of a firmware malware in 2021 and is it possible?

I was reading a few articles online about how some firmware can be altered into malware and essentially infect a hardware equipment for its entire life time. Like almost all SSDs in the industry ...
0 votes
1 answer
174 views

How to get information about segments of physical memory not described in System.map on linux

When I do in linux root shell cat /boot/System.map-$(uname -r) it returns me segments of memory but there is a big gap around phys_startup_64: 00000000000228c0 D softnet_data 0000000000022a80 d ...
2 votes
1 answer
127 views

Can a host OS be attacked through the network stack?

Forenote: I'm not familiar with how virtualisation works on a low-level (but I'd certainly like to learn) so this question could arise from ignorance. Example Scenario: One virtualised router is ...
0 votes
1 answer
401 views

How do you adjust offest and kernel stack size from an exploit?

Needless to I say I have no idea how to do this. I'm performing a pentest and I found an exploit related the box : https://www.exploit-db.com/exploits/44298 In the exploit comments, the author said : ...
0 votes
2 answers
115 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
0 votes
1 answer
327 views

AES-256 ESSIV in dm-crypt

I am playing around with disk encryption. https://gitlab.com/cryptsetup/cryptsetup/-/wikis/DMCrypt#iv-generators says: essiv: "encrypted sector|salt initial vector", the sector number is encrypted ...
1 vote
0 answers
94 views

Kernel ROP crashes running OS

I was experimenting to see if I can make an ROP chain within the kernel. In the kernel debugging mode, I can make the first jump to an arbitrary gadget address without any problem. But the problem ...
0 votes
1 answer
362 views

What is the best way to restrict /proc fs from malicious users (linux)?

I am trying to make a restriction to procfs like only a certain groups of members can perform read and write actions. kernel document says we can do that by setting hidepid and gid in /etc/fstab. It ...
17 votes
3 answers
29k views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...